Crypto-asset regulation and tokenization in Luxembourg

In Luxembourg, a digital asset project’s regulatory treatment depends on what the token represents and what each participant does. The EU Markets in Crypto-Assets Regulation, known as MiCA, governs assets and services within its scope. Where a token represents a financial instrument, such as a share or bond, securities rules apply instead. Luxembourg legislation allows distributed ledgers to perform certain functions in the issuance and circulation of those securities.

This distinction explains why an exchange platform and an issuance of tokenized fund units do not necessarily follow the same route. Before selecting providers or technology, a business should identify the issuer, record keeper, custodian and intended clients. This guide connects those decisions with the CSSF’s responsibilities, market access requirements and the rights acquired by the holder.

Which rules apply to each asset and activity

The first question is legal: what can the token holder claim, and against whom? Digital representation does not by itself turn a transferable security into a crypto-asset governed by MiCA. The regulation excludes financial instruments from its scope. Tokenized debt must be assessed under the applicable securities, offering and investment services rules, even if it uses the same network as a crypto-asset platform.

Assets within MiCA also follow different regimes. E-money tokens, or EMTs, seek to maintain a stable value by reference to one official currency. Asset-referenced tokens, or ARTs, use other references and are not EMTs. The regulation separates both categories from the remaining crypto-assets and distinguishes issuers or offerors from client service providers. The commercial description “stablecoin” does not settle that classification.

At the national level, the Law of 6 February 2025 designates the CSSF as the competent authority for MiCA. That law also abolished the former VASP registration and brought crypto-asset service providers within the 2004 anti-money laundering law. In parallel, the reforms known as Blockchain I to IV adapt securities legislation to distributed ledgers: recognition of accounts and transfers, issuance accounts on DLT, inclusion in the financial collateral law of securities accounts held on distributed ledgers and, finally, the control agent. The European framework must therefore be read alongside the law governing the represented right. Incorporating a technology company does not by itself identify the permissions its activities require.

What the CSSF supervises and which registers to check

The Commission de Surveillance du Secteur Financier, or CSSF, supervises Luxembourg financial entities and activities within its remit. Its MiCA information distinguishes service providers, issuers and asset categories. When assessing an intermediary, a business should check its legal name, authorized services and geographical scope. A trading name or another group company’s authorization does not replace that verification.

National supervision operates alongside European responsibilities. The European Banking Authority, or EBA, has the functions assigned by MiCA for certain issuers, particularly where their tokens are classified as significant. For anti-money laundering purposes, the Cellule de renseignement financier, or CRF, receives and analyzes suspicious transaction reports. These are separate functions: reporting to the financial intelligence unit does not grant commercial permission.

Register checks should also cover providers established in other Member States using the European cross-border procedure. A business engaging custody or brokerage services needs to connect a specific entity with the function it will perform. The register establishes a regulatory status; it does not guarantee an asset’s returns or determine the validity of every contract associated with it.

What a project needs before it can operate

For a new firm providing services within MiCA, the usual route is authorization as a crypto-asset service provider, or CASP. Article 59 requires the permission to cover the services actually provided. Article 60 offers a different route for certain existing regulated financial entities, through notification and within the limits of their category. A bank and a new custody platform may therefore follow different procedures.

The project must explain how the activity will work: who controls keys, how orders are executed, what resources the entity maintains and which functions it outsources. A technology provider able to dispose of client assets needs a different assessment from a business merely developing software. Article 65 provides a procedure for delivering authorized services in other Member States; it does not extend permission to financial instruments or replace payment requirements.

Issuance needs a separate assessment. The CSSF publishes specific procedures for ARTs, involving issuer authorization or the route for credit institutions, and for EMTs, whose general regime requires a credit institution or electronic money institution. For other crypto-assets, offering duties may include a white paper, notification and publication, subject to applicable exemptions. Notifying a document does not by itself mean the product has been approved.

One date matters when comparing historical documents with the current position: the VASP transitional period ended on July 1, 2026. The former registration no longer permits continued MiCA services on its own, nor is it available to new entrants: national law repealed it, so firms that did not use the transitional period must go directly to MiCA authorization. A pending application must not be presented as permission already granted. An entity’s continuation and solicitation from third countries must be assessed against the applicable rules and exceptions.

How tokenized securities are recorded and transferred

For securities issuance, the record must identify what has been issued and how rights are attributed. Article 18a of the securities circulation law recognizes accounts and transfers through secure electronic recording mechanisms, including distributed ledgers, subject to its conditions. Technology thus operates within a legal holding and circulation framework; an isolated technical entry does not demonstrate that the framework has been satisfied.

The dematerialized securities law, amended in December 2024, introduces the control agent, an optional role the issuer may appoint for unlisted securities as an alternative to a settlement organization or central account keeper. It maintains the issuance account, tracks the holding chain and reconciles issued securities with recorded holdings. Only investment firms and credit institutions within the meaning of the 1993 financial sector law, or settlement organizations, can perform this function. Article 21a requires organizational arrangements and controls, together with notification to the CSSF at least two months before starting. The CSSF may prohibit the activity if the conditions are unmet or information is insufficient. The same reform extended the central account keeper regime, previously limited to debt securities, to equity securities and fund units.

A less frequently cited element is collateral. The Law of March 15, 2023, brought securities accounts held through secure electronic recording mechanisms, including distributed ledgers, within Luxembourg's law of August 5, 2005, on financial collateral arrangements. For leveraged or collateralized transactions, that treatment must be checked together with the regime governing the security and the register.

These functions have a practical application. On July 21, 2025, Luxembourg for Finance announced Investre as the first control agent under Blockchain IV. The announcement illustrates implementation of the reform; it does not transfer that entity’s permissions to another platform. Record keeping does not by itself resolve prospectus, distribution, fund management or trading infrastructure requirements.

Settlement is another part of the design. In Project Venus, the central banks of Luxembourg and France participated in a European Investment Bank transaction using a digital representation of central bank money. The case establishes a particular issuance and settlement experiment, rather than open permission to use any stablecoin. A new transaction must coordinate the securities transfer, payment and consequences of settlement failure.

What matters to the investor is the acquired right: shares, debt, fund units or another eligible entitlement. If a vehicle invests in real estate, the token may represent a position against that vehicle without granting direct ownership of the building. Contracts, records and transfer rules must remain consistent in cases such as lost keys, selling restrictions or insolvency.

Which obligations continue throughout the activity

Authorization starts a supervised activity that needs ongoing controls. The anti-money laundering framework requires covered entities to perform risk-based due diligence and monitoring. The Transfer of Funds Regulation adds originator and beneficiary information requirements for transfers within its scope. These checks must form part of operations rather than being reduced to an onboarding form. CSSF Circular 25/896 also makes the EBA guidelines on controls to comply with restrictive measures applicable to CASPs from December 30, 2025. For tax purposes, the Law of March 27, 2026 transposes the European administrative cooperation directive applicable to crypto-assets (DAC8): it requires providers to identify clients' tax residence and report information on their transactions from January 1, 2026.

The Digital Operational Resilience Act, or DORA, governs digital operational resilience for entities within its scope. A business outsourcing custody or infrastructure should connect these requirements with its contracts, incident management and service continuity. Selecting a public or private network does not determine who is responsible to the client or how access to assets can be recovered.

In its July 2026 analysis, Loyens & Loeff highlights local substance, application quality and operational capability as practical issues in dealing with the CSSF. This helps prepare a project but does not establish a statutory timetable or guarantee authorization. Resources and governance must reflect the entity’s complexity and services.

What to define before starting a project

Preparation begins with a description of the product and its participants. It should identify the token’s legal right, issuer, intended investors, distribution jurisdictions and the entities performing record keeping, custody, management and trading. This allows the business to assess permissions and identify functions requiring another regulated participant before designing smart contracts or committing to launch dates.

Tax, fund or securitization rules and the particular conditions of an offer require their own assessment. The applicable version of the law must also be checked: the CSSF’s informational consolidations defer to the official journal where discrepancies arise. Firms should also follow Commission proposal COM(2025) 943 of December 4, 2025, which would reform the DLT Pilot Regime and transfer the authorization and supervision of crypto-asset service providers to ESMA, except for credit institutions and Article 60 MiCA entities; it remains pending adoption and is not law in force. A digital securities framework helps identify a legal route, but it does not guarantee buyers, liquidity or the viability of a particular issuance.

To understand how this framework applies to your project, discuss your case with our team.