Crypto-assets

The CSSF is aware of the attention paid to crypto-assets by the general public and professionals in recent years. These assets exist in the form of tokens issued using distributed ledger technology and may have various characteristics. Faced with such financial innovations, the CSSF promotes a neutral and prudent regulatory approach.

The CSSF’s message is therefore not just a warning but invites investors to be prudent and recommends that they inform themselves about crypto-assets before making any decisions. Virtual currencies, such as bitcoin, are a sub-category of crypto-assets and are not suitable for all investor profiles due to their volatility.

It is therefore crucial that any investor considering the acquisition of crypto-assets understands the risks they pose and the regulatory framework applicable to them. In this respect, this section provides investors with information on the Markets in Crypto-Assets Regulation (“MiCAR”), the national regime on Virtual Asset Service Providers (“VASPs”) and publications issued by the CSSF on the topic of crypto-assets.

With MiCAR (Regulation (EU) 2023/1114) on crypto-asset markets, the European Union is endowed with a harmonised regulatory framework for the crypto-asset market that applies both to traditional financial sector institutions and to new emerging players in the crypto ecosystem. These entities must meet a set of specific requirements to benefit from a regulated status recognised at European level.

MiCAR is part of the Digital Finance Package published by the European Commission on 24 September 2020 and aims to bring legal certainty to the crypto-asset ecosystem and support innovation while safeguarding investor protection, market integrity and financial stability. To this end, the EU establishes a harmonised framework for the issuance, offer to the public, admission to trading and provision of services related to crypto-assets in the EU.

MiCAR creates a regime dedicated to crypto-assets that are not already covered by the European financial services legislation and groups them into three main categories: asset-referenced tokens (“ARTs”), e-money tokens (“EMTs”) and other crypto-assets.

Crypto-asset service providers (“CASPs”) are subject to an authorisation regime involving notably prudential and organisational requirements and consequently are subject to the CSSF’s supervision. Certain categories of financial entities that already have a regulated status (i.e. credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies and alternative investment fund managers) may provide certain services on crypto-assets upon simple notification.

In summary, MiCAR affects in particular:

• crypto-asset service providers (“CASPs”);
• issuers of e-money tokens (“EMTs”);
• issuers of asset-referenced tokens (“ARTs”);
• issuers of crypto-assets other than EMTs or ARTs.

MiCAR entered into force on 29 June 2023 and became applicable:

• on 30 June 2024 regarding the provisions of Titles III and IV of the regulation relating to the authorisation and supervision of issuers of ARTs/EMTs;
• on 30 December 2024 for the rest of the provisions provided by the regulation, in particular on CASPs and issuers of crypto-assets other than ARTs or EMTs.

Unlike CASPs authorised under MiCAR, virtual asset service providers (also known as VASPs or PSAV in French) registered with the CSSF are subject to limited supervision, mainly focused on AML/CFT issues, as they are governed by the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“AML/CFT Law”).

The national VASP regime will continue to apply alongside MiCAR during a transitional period.

In accordance with Article 143(3) of MiCAR and Article 20 of the National Law of 6 February 2025, which designates the CSSF as the competent authority responsible for performing the duties and obligations provided for by MiCAR, a transitional period of 18 months starting on 30 December 2024 and ending on 1 July 2026 is provided for virtual asset service providers (“VASPs”) registered with the CSSF before 30 December 2024. VASPs may continue to provide the services for which they have been registered until 1 July 2026, or until authorisation is granted or refused in accordance with Article 63 of MiCAR, whichever comes first.

Before investing or using a service related to crypto-assets:

1. Learn more about the risks associated with crypto-assets.
2. Check the authorisations or registrations obtained by an issuer or service provider on the registers of the competent authorities.
3. Read the white paper carefully to understand the risks and rights associated with crypto-assets.
4. Be wary of solicitations from unauthorised service providers or those located outside the EU.
5. Keep an eye on the warnings published by the CSSF and European supervisory authorities (the European Banking Authority – “EBA”, the European Securities and Markets Authority – “ESMA”, and the European Insurance and Occupational Pensions Authority – “EIOPA”) to stay informed.

The CSSF recalls that investments in crypto-assets entail significant risks, including:

• High volatility: Crypto-assets prices can fluctuate sharply over short periods of time.
• Absence of guarantees: Unlike bank deposits, crypto-assets are not protected by mechanisms such as deposit guarantee funds.
• Technological risks: Security breaches, hacking or technical errors can lead to major losses.
• Regulatory risks: MiCAR only applies to players authorised in the EU. Third-country providers may not offer the same protection.

We also recommend consulting the warning issued by ESMA on 13 December 2024 (reference ESMA35-1872330276-1971), which is available on the CSSF website, for further information on the dangers associated with these assets.

Although MiCAR imposes transparency obligations and introduces oversight mechanisms that may apply to crypto-asset issuers and crypto-asset service providers, it does not eliminate all risks. MiCAR guarantees are less extensive than those of traditional investment products. While MiCAR aims to strengthen investor protection, it does not offer the same level of protection as for traditional investment products.

Consumers wishing to learn more about crypto-assets may also refer to the letzfin website.

To find out more about the regulatory framework applicable to an entity and the protections that investors may benefit from, they should consult the entity registers of the competent authorities.

• In the case of entities providing services or issuing crypto-assets in Luxembourg, consumers are encouraged to refer to the CSSF’s register. In particular, it lists the entities supervised by the CSSF under MiCAR (i.e. issuers of EMTs, issuers of ARTs and CASPs) and under the local framework for virtual assets (i.e. VASPs-PSAV). An entity operating in Luxembourg that is not listed in the CSSF register may be listed in ESMA’s European register, as it provides services or issues crypto-assets on the basis of the European passport. To identify them, please refer to the following point.
• In the case of entities operating within the EU, ESMA makes the following registers available on its website: Register of crypto-asset white papers, issuers of ART , issuers of EMT and crypto-asset service providers; Register of non-compliant entities providing crypto-asset services.
• In the case of third-country entities (i.e. established outside the EU) that are not subject to MiCAR, consumers are encouraged to refer to the provisions applicable in these entities’ country of origin.

MiCAR introduces transparency obligations for crypto-asset issuers requiring them to publish an information document known as a white paper. Consumers can read this document to gain a deeper understanding of the characteristics of the token issued, the risks associated with it and the rights attached to it.

Only white papers on ARTs need to be approved by the CSSF or another competent authority in the EU before publication. In the case of unapproved white papers, the issuer remains solely responsible for the statements included therein.

Investors must be informed that they are not protected by MiCAR when crypto-asset services are provided by companies not authorised in the EU.

Investments in crypto-assets or related services offered by non-European companies involve generally weaker guarantees, increased risks of fraud and scams, and limited recourse (if any) in the event of disputes or claims against the provider.