Crypto license in Luxembourg: MiCA CASP requirements (2026)

Yes. To provide crypto-asset services in Luxembourg you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Commission de Surveillance du Secteur Financier (CSSF), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.

The Commission de Surveillance du Secteur Financier (CSSF).

An application fee of roughly €5,000–€25,000, plus ongoing supervisory fees.

Typically about 40 working days of substantive review; 1–3 months for a well-prepared application.

The application file centres on programme of operations describing each crypto-asset service you will provide; business plan with three-year financial projections; evidence of prudential safeguards (own funds or qualifying insurance); governance arrangements, organisational chart and internal-control description; plus fit-and-proper evidence for directors and qualifying shareholders.

Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU. Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation. The authority then assesses the file and, once authorised, you can begin operating.

Yes — a single MiCA CASP licence passports across all 27 EU member states.

MiCA applies in full since 30 December 2024. The Luxembourg implementing law (published in the Official Journal on 10 February 2025) designates the CSSF as the competent authority with supervisory, investigative and sanctioning powers over CASPs and ART/EMT issuers.

VASPs registered with the CSSF before 30 December 2024 may continue to operate under a national transitional regime until 1 July 2026; after that date a CASP authorisation under MiCA is required to provide crypto-asset services in or from Luxembourg.

The Law of 20 December 2024 (Blockchain Law IV, in force 31 December 2024) amended the 6 April 2013 law on dematerialised securities to extend the DLT framework to unlisted equity securities and introduced the 'control agent' role (bank, investment firm or settlement organisation, on prior notification to the CSSF).

The CSSF has already granted MiCA authorisations to several major operators, including Zodia Custody (CASP) and Alipay Europe (EMT licence for a euro stablecoin); Banking Circle issues the EURI EMT from Luxembourg under CSSF supervision, evidence that the regime is operational, not just on paper.

Luxembourg transposed the EU DAC8 directive (Council Directive (EU) 2023/2226) and the OECD Crypto-Asset Reporting Framework through the law of 27 March 2026, imposing structured due-diligence, data-collection and reporting obligations on CASPs and equivalent operators from 1 January 2026.

The CSSF published Version 7 of its FAQ on virtual/crypto-assets on 4 February 2026, aligning terminology with MiCA, requiring prior CSSF notification before a fund invests in crypto-assets, case-by-case risk assessment, internal control functions and investor disclosure, retail UCITS still cannot gain direct exposure.