Digital Assets in Luxembourg: A regulatory roadmap for entrepreneurs (2025-2026)
- Erwin SOTIRI
- 5 hours ago
- 9 min read
Luxembourg has successfully entrenched its position as a global leader and the premier financial centre in Europe for digital assets through a progressive regulatory environment and a clear national strategy for digitalisation. This strategic positioning is the result of a multi-year effort to integrate distributed ledger technology (DLT) into the bedrock of its financial infrastructure, earning the jurisdiction the reputation of a "regulatory pioneer" and a "first mover" in the digital finance space. While other major jurisdictions like the United States have historically relied on "regulation by enforcement" and the United Kingdom has adopted a slower, "measured approach" targeting late 2026 for comprehensive regulation, Luxembourg has prioritised legislative clarity and speed.
A cornerstone of this ecosystem is the unified framework offered by the Commission de Surveillance du Secteur Financier (CSSF). The CSSF serves as the sole competent authority for the Markets in Crypto-Assets Regulation (MiCA) in Luxembourg, providing a streamlined and predictable regulatory interface for entrepreneurs. Unlike the fragmented oversight seen in other regions, the CSSF manages the entire lifecycle of a digital asset entity, from preliminary dialogue and authorisation to ongoing supervision.
The legislative backbone: The "Blockchain Laws"
Luxembourg’s legal certainty is underpinned by a series of four targeted reforms known as the "Blockchain Laws," which have systematically removed legal ambiguities associated with DLT, evolving from simple transfers to complex issuance structures.
• Blockchain Law I (2019): Registration and Transfer. Enacted on 1 March 2019, this foundational law amended the Law of 1 August 2001 on the circulation of securities. It explicitly recognised DLT as a valid technology for holding securities accounts and registering the transfer of securities. By granting transactions executed via DLT the same legal status as traditional book-entry transfers between securities accounts, Luxembourg provided early legal certainty that digital transfers were valid and enforceable.
• Blockchain Law II (2021): Issuance and the Central Account Keeper. Passed on 22 January 2021, this law amended the Law of 6 April 2013 on dematerialised securities. It expanded the framework by allowing authorised issuers to use DLT not just for transfer, but for the issuance and conversion of dematerialised securities. Crucially, it introduced the possibility for credit institutions and investment firms to act as Central Account Keepers (CAK) for unlisted debt securities. This mechanism enabled leading financial groups to issue debt securities in a fully DLT-based manner, a framework notably utilised by the European Investment Bank for major digital bond issuances.
• Blockchain Law III (2023): Collateral and the DLT Pilot Regime. Enacted on 15 March 2023, this law further matured the framework by amending the Law of 5 August 2005 regarding financial collateral arrangements. It clarified that the validity and effectiveness of collateral are not compromised by the use of DLT, ensuring creditors have the same protection for DLT-based assets as traditional ones. It also formally recognized instruments issued under the EU DLT Pilot Regime as "financial instruments" within Luxembourg's Law on the Financial Sector.
• Blockchain Law IV (December 2024): The "Control Agent" and Equity. Adopted on 19 December 2024, this legislation introduced the transformative status of the "Control Agent" (or monitoring agent). This role was created to provide a flexible alternative to the traditional Central Account Keeper (CAK) model. Unlike a CAK, which must hold the issuance account and act as the top-tier custodian, the Control Agent decouples these functions. The Control Agent maintains the issuance account on the blockchain and monitors the chain of custody, allowing securities to be booked directly across various custodians without requiring a sub-custody relationship with the Control Agent. Furthermore, this law expanded the DLT framework to include unlisted equity securities, opening new avenues for the tokenisation of investment fund units.
3. The New Era: MiCA Implementation & The VASP-to-CASP Transition
The full application of MiCA signals the end of fragmented national regimes. Luxembourg has managed this transition through specific legislative milestones.
• The Law of January 2025: On 22 January 2025, the Luxembourg Parliament adopted the law implementing MiCA into national law. This legislation formally designates the CSSF’s supervisory powers and introduces clear enforcement mechanisms, including penalties for violations.
• Repeal of the VASP Regime: The new law officially repeals the Virtual Asset Service Provider (VASP) registration requirement under the AML/CFT Law of 2004. New market entrants can no longer register as VASPs and must immediately seek full Crypto-Asset Service Provider (CASP) authorisation to operate.
• Transitional Period (Grandfathering): To prevent market disruption, a transitional "grandfathering" period of 18 months is in effect, allowing existing registered VASPs to operate until 1 July 2026. However, to benefit from this transition and avoid service interruption, entities were required to have a license application pending or submitted by the critical deadline of 30 December 2024. Existing VASPs cannot passport their services to other EU member states during this transitional period; they remain bound to the national regime until fully authorised as CASPs.
• Licensing Requirements: The CSSF authorisation process requires a dossier built on four pillars: a detailed Program of Activities; robust Governance (including fit and proper directors); Technical and Operational Resilience (compliance with DORA and ICT security); and sufficient Prudential Resources (ranging from €50,000 to €150,000 depending on services
Asset Management: Crypto Funds
Luxembourg has established itself as a sophisticated hub for crypto-funds by leveraging its existing toolbox of alternative investment structures. The regulator has adopted a nuanced approach that differentiates between asset types and investor classes, balancing innovation with strict consumer protection.
Fund eligibility: The divide between AIFs and UCITS
The CSSF distinguishes between "Virtual Assets" (e.g., cryptocurrencies like Bitcoin) and "Digital Assets" (financial instruments issued on DLT). This distinction dictates fund eligibility:
• Alternative Investment Funds (AIFs):
AIFs are the primary vehicle for crypto-exposure. They are permitted to invest directly and indirectly in virtual assets, provided they market their units exclusively to well-informed investors. This includes authorized AIFMs and registered AIFMs, though the specific authorization extension is required for the former.
• UCITS & Pension Funds:
Undertakings for Collective Investment in Transferable Securities (UCITS) and pension funds are prohibited from investing directly or indirectly in "virtual assets" due to volatility, liquidity, and technological risks. However, this restriction does not apply to "Digital Assets" that qualify as financial instruments (e.g., tokenised shares or bonds). If a digital asset fulfills the conditions of a financial instrument, it may potentially fall within the scope of eligible investments for UCITS, provided it meets liquidity and valuation criteria.
Manager Authorization: The "Other-Other" Strategy
Existing authorized Alternative Investment Fund Managers (AIFMs) cannot simply add crypto-assets to their portfolio; they must obtain a specific license extension from the CSSF for the strategy defined as "Other-Other Fund Virtual assets". To secure this extension, the CSSF requires a comprehensive dossier demonstrating specific competence, including:
Risk Management Policy: A bespoke policy detailing how risks specific to virtual assets (volatility, custody, technology) are managed.
Valuation Policy: Concrete rules on how the value of virtual assets will be determined, addressing the challenge of fragmented liquidity across exchanges.
Portfolio Manager Experience: Evidence that the portfolio manager and other involved entities possess actual experience and deep knowledge of the virtual asset ecosystem.
Investment Structure: Clarification on whether investment is direct or indirect (e.g., via derivatives) and a description of the targeted distribution channels.
The Depositary Function: Custody vs. Record-Keeping
The role of the depositary is critical and carries specific liability implications depending on the nature of the asset and the custody model:
"Other Assets" (Record-Keeping): For virtual assets that do not qualify as financial instruments and cannot be held in custody (e.g., certain utility tokens), the depositary’s liability is limited to ownership verification and record-keeping, rather than restitution.
Custodian Wallet Services (Restitution): If a depositary provides safekeeping for virtual assets (holding the cryptographic keys), it must register as a VASP (now transitioning to CASP under MiCA). In this scenario, the assets must be recognized off-balance sheet, and the depositary assumes a restitution liability if the assets are lost.
Appointment of Specialized Custodians: If the fund appoints a specialized Virtual Asset Service Provider (VASP) directly to hold the custodian wallets (and the depositary does not provide this service), the specialized VASP becomes liable for restitution, not the depositary. However, the depositary retains oversight duties regarding ownership verification.
Tokenisation of Fund Units (Blockchain Law IV)
The enactment of Blockchain Law IV in December 2024 has opened significant opportunities for the administration of the funds themselves.
Unlisted Equity Securities: The law expands the DLT framework to include unlisted equity securities, explicitly allowing for the tokenization of investment fund units.
The Control Agent: This law introduced the "Control Agent" (or monitoring agent), a role that simplifies the custody chain for tokenized funds. Previously, a Central Account Keeper (CAK) had to hold the issuance account and act as the top-tier custodian. The new Control Agent decouples these roles: they monitor the chain of custody on the blockchain and reconcile issues, but do not need to act as the custodian.
Operational Flexibility: This allows tokenized fund units to be booked directly with various custodians without requiring a sub-custody link to the Control Agent, streamlining the distribution of tokenized funds.
New AML/CFT Reporting for Unregulated Funds
Entrepreneurs launching unregulated AIFs (including RAIFs) must be aware of tightened AML compliance. As of 2025, the Administration de l’enregistrement, des domaines et de la TVA (AED) requires all unregulated AIFs - even those internally managed - to submit an annual AML/CFT questionnaire and a report signed by the responsable du contrôle (RC). Failure to establish a comprehensive AML/CFT framework immediately is no longer exempted based on proportionality.
Tokenisation of Real-World Assets (RWA): Real Estate and Private Equity
While MiCA regulates "crypto-assets," Luxembourg has simultaneously cultivated a parallel, robust legal framework for Security Tokens - digital representations of financial instruments. For entrepreneurs looking to tokenise real-world assets (RWA) such as real estate, private equity, or art, understanding the distinction between the "Blockchain Laws" and MiCA is vital.
The Legal Foundation: From "Virtual Asset" to "Financial Instrument"
Unlike cryptocurrencies (e.g., Bitcoin), tokenised real estate assets typically qualify as financial instruments (e.g., shares in a property company or debt instruments issued by a securitisation vehicle). Consequently, they fall outside the scope of MiCA and are governed by Luxembourg’s specific "Blockchain Laws" and existing securities regulations (MiFID II, Prospectus Regulation).
Luxembourg’s legislative progression provides a clear path for RWA tokenisation:
Blockchain Law I (2019) & II (2021): Established that DLT can be used to register and transfer securities, granting digital tokens the same legal status as traditional book-entry securities.
Blockchain Law III (2023): Confirmed that DLT-native financial instruments can be used as collateral, ensuring that tokenised real estate assets can be pledged to secure financing with full legal certainty.
The Game Changer: Blockchain Law IV and Unlisted Equity
For real estate entrepreneurs, Blockchain Law IV (December 2024) is the most critical development. Previously, the DLT framework focused heavily on debt securities. Law IV explicitly expands the scope to include unlisted equity securities.
Why this matters for Real Estate:
Real estate is rarely tokenised directly (i.e., tokenising the building itself). Instead, it is structured through Special Purpose Vehicles (SPVs) or investment funds. Tokenising the shares (equity) or units of these unlisted vehicles is now explicitly supported by statute. This allows for the fractionalisation of high-value properties, making them accessible to a broader investor base.
Operationalising Tokenisation: The "Control Agent"
Blockchain Law IV introduces the "Control Agent" (Monitoring Agent), a role designed to solve the specific operational bottlenecks of tokenising private assets.
Breaking the Silo: Under the previous "Central Account Keeper" (CAK) model, the entity managing the token issuance also had to act as the top-tier custodian. This centralized model was inefficient for unlisted assets where investors might use different custodians.
The New Role: The Control Agent is responsible for maintaining the issuance account on the blockchain and verifying the chain of ownership. Crucially, they do not need to act as the custodian for the investors. This allows tokenised real estate shares to be distributed across various custodians while the Control Agent ensures the integrity of the issuance via DLT.
Eligible Entities: This role can be performed by Luxembourg or EU credit institutions, investment firms, or settlement organisations, subject to CSSF notification.
Structuring the Vehicle: Securitisation and Funds
Entrepreneurs typically use Luxembourg’s securitisation vehicles (SV) or Alternative Investment Funds (AIFs) to hold the underlying real estate asset.
Securitisation: An SV can issue digital tokens (debt or equity) backed by the rental income or capital appreciation of the property. The SV uses DLT to track ownership and automate corporate actions (e.g., distributing rental yields via smart contracts).
Fund Tokenisation: The new framework allows for the native issuance of fund units on the blockchain. Companies like Investre have recently become the first to receive the Control Agent license, signalling the operational readiness of this model for large-scale deployment.
Key Compliance Considerations for RWAs
AML/CFT: While the asset is "real world," the transfer mechanism is digital. Real estate agents (REAs) in Luxembourg are identified as having a weak understanding of AML risks. Tokenisation platforms must bridge this gap by enforcing strict KYC/AML on the digital secondary market, ensuring that the "Travel Rule" (transfer of originator/beneficiary data) is applied even for unlisted security tokens if facilitated by CASPs.
Depositary Duties: For AIFs investing in tokenised real estate, the Depositary’s role shifts from custody (holding keys) to ownership verification and record-keeping, as these assets are often considered "other assets" rather than financial instruments held in custody, unless they are strictly financial instruments on DLT.
Luxembourg is actively positioning itself as the hub for this activity. Start-ups are leading the market in tokenised investment products, and the ecosystem is supported by institutional moves. This environment offers entrepreneurs not just a legal framework, but a proof-of-concept ecosystem that is already operational.
This comprehensive overview of digital asset regulation has been designed to equip you with the knowledge necessary to understand and navigate this intricate domain. By appreciating the regulatory imperatives and challenges, you can better position yourself or your organization to operate effectively within the evolving digital asset ecosystem.
