Luxembourg CSSF MiCAR Competent Authority Law of 6 February 2025

MiCAR is an EU regulation, so its substantive crypto-asset rules apply directly across Member States. The Luxembourg law does not replace MiCAR; it operationalises the domestic supervisory layer needed for Luxembourg. The CSSF describes MiCAR as a harmonised regulatory framework applying to traditional financial-sector institutions and new crypto-ecosystem actors, with regulated status at European level. The CSSF’s MiCAR materials identify affected categories including crypto-asset service providers (CASPs), issuers of e-money tokens (EMTs), issuers of asset-referenced tokens (ARTs), and issuers of crypto-assets other than EMTs or ARTs.

The law therefore matters most as a jurisdictional bridge. It confirms the CSSF as the authority through which Luxembourg-based MiCAR activity is supervised, while MiCAR remains the primary EU-level rulebook for authorisation, issuance, admission to trading, service provision, market integrity, and related safeguards. The CSSF notes that MiCAR’s ART and EMT provisions became applicable on 30 June 2024, while the rest of the regulation, including CASP and other crypto-asset issuer provisions, became applicable on 30 December 2024.

• Competent authority designation: The law officially designates the CSSF as Luxembourg’s competent authority under MiCAR.
• Supervisory and investigative powers: The CSSF states that the law provides the supervisory and investigative powers needed to exercise its MiCAR functions.
• Sanctions regime: The law places a national sanctions regime alongside the CSSF’s MiCAR supervisory role.
• Transfer-of-funds implementation: The law also implements Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets and transposes Article 38 of that regulation.
• Existing VASP transition: VASPs registered with the CSSF before 30 December 2024 remained on the CSSF VASP register until 1 July 2026 or until MiCAR authorisation was granted or refused, whichever came first.

For Luxembourg, the law aligns domestic financial-sector supervision with the EU’s MiCAR perimeter. The CSSF’s consumer-facing materials state that CASPs are subject to an authorisation regime involving prudential and organisational requirements and are subject to CSSF supervision. Certain already-regulated financial entities may provide specified crypto-asset services by notification rather than a full new authorisation, depending on MiCAR and the relevant entity status.

The CSSF also links MiCAR supervision to market-abuse reporting. Its MiCAR page states that Article 92 MiCAR obliges persons established in Luxembourg and professionally arranging or executing in-scope crypto-asset transactions to report reasonable suspicions of market abuse to the CSSF without delay. This makes the CSSF the reporting and supervisory focal point for Luxembourg market-integrity obligations under the EU regime.

As of 22 July 2026, this profile treats the Luxembourg law as in force. The principal national effective date is 10 February 2025, the publication date identified by the CSSF. The VASP transition referenced by the law has now ended: on 2 July 2026, the CSSF stated that the transition period ended on 1 July 2026 and that crypto-asset services in the EU may only be provided by authorised CASPs, subject to limited wind-down actions for unauthorised providers.