Fintech & digital payments rules in Luxembourg (2026)

The CSSF published Circular 26/906, a sweeping update establishing unified central-administration, internal-governance and risk-management rules for Luxembourg payment institutions, e-money institutions and AISPs, effective 30 June 2026. It formalises the three-lines-of-defence model, mandates daily client-fund reconciliations, introduces transfer-pricing obligations, and requires annual compliance attestations submitted to the CSSF.

Coinbase received its MiCA crypto-asset service provider authorisation from the CSSF, becoming the first major US exchange to obtain an EU-wide licence under the new framework, and relocated its EU hub from Ireland to Luxembourg. The single licence is passportable across all 27 EU member states, serving over 450 million people.

The Law of 6 February 2025, published in the Official Gazette on 10 February 2025, formally designated the CSSF as Luxembourg's sole competent authority under MiCAR, granting it supervisory, investigative and sanctioning powers over CASPs, ART issuers and EMT issuers. VASPs registered before 30 December 2024 benefit from a transitional period until 1 July 2026.

Regulation (EU) 2022/2554 on Digital Operational Resilience (DORA) became directly applicable on 17 January 2025, with the CSSF as Luxembourg's competent authority for payment institutions and fintech entities. DORA requirements on ICT risk management, incident reporting, resilience testing and third-party provider risk take precedence over overlapping CSSF circulars from that date.

The Law of 20 December 2024 (Blockchain IV) entered into force on 31 December 2024, amending the Law of 6 April 2013 on dematerialised securities to allow issuance and custody of equities, fund units and tokenised physical assets via DLT. It introduced a new 'control agent' role, enabled multi-custodian EU-wide settlement chains, and permitted smart-contract-automated payment obligations (interest, dividends, repayments).

The Law of 14 March 2023 (Blockchain III) transposed the EU DLT Pilot Regime (Regulation 2022/858), enabling firms to operate licensed DLT-based trading and settlement venues in Luxembourg under a flexible regulatory framework effective 23 March 2023. It also amended the Law of 5 August 2005 on financial collateral to explicitly recognise DLT-registered instruments in collateral arrangements, providing legal certainty for digital-asset financing.

The Law of 21 July 2021 entered into force on 30 July 2021, transferring from the Minister of Finance to the CSSF the exclusive power to grant, refuse and withdraw authorisations for payment institutions and e-money institutions. This streamlined fintech licensing, created a single regulatory point of contact, and aligned Luxembourg with best European practice for centralised financial supervision.

The Law of 25 March 2020, transposing AMLD5 (EU Directive 2018/843), entered into force on 30 March 2020 and introduced Luxembourg's first mandatory registration regime for virtual asset service providers (VASPs) under CSSF supervision. Entities offering VA exchange, transfer, safekeeping or investment services must register with the CSSF and comply with full AML/CFT obligations before operating.

The Law of 1 March 2019 (Blockchain I) amended the Law of 1 August 2001 on the circulation of securities, making Luxembourg one of the EU's first member states to grant DLT-based issuance and transfer of securities the same legal standing as traditional book-entry transactions. This foundational step underpins all subsequent blockchain legislation and Luxembourg's strategy as a European DLT and fintech hub.

Luxembourg amended the 2009 Payment Services Law to transpose PSD2 (EU Directive 2015/2366), more than six months past the January 2018 EU deadline. The amendment created two new licensed third-party provider categories — payment-initiation service providers (PISPs) and account-information service providers (AISPs) — mandated strong customer authentication, and tightened operational-security incident reporting obligations for all payment institutions.

The Payment Services Law (PSL) of 10 November 2009 transposed PSD1 (EU Directive 2007/64/EC) and established Luxembourg's core licensing framework for payment institutions and e-money institutions under CSSF supervision. It defines authorisation requirements, passporting rights, conduct-of-business rules and client-fund safeguarding obligations that remain the bedrock of the country's PI/EMI regulatory architecture today.