Crypto-Assets Service Providers (CASPs)

Pursuant to Article 3, paragraph 1, point 15 of MiCAR (Regulation (EU) 2023/1114), a crypto-asset service provider (“CASP”) means a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59 MiCAR.

CASPs are subject to an authorisation regime involving notably prudential and organisational requirements and consequently will be subject to a supervisory regime by the CSSF.

Certain categories of entities that already have a regulated status (i.e. credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies, alternative investment fund managers) can provide certain services on crypto-assets upon a simple notification.

The types of crypto-asset services that fall under the scope of MiCAR are:

• Custody and administration of crypto-assets on behalf of clients,
• Operation of a trading platform for crypto-assets,
• Exchange of crypto-assets for funds,
• Exchange of crypto-assets for other crypto-assets,
• Execution of orders for crypto-assets on behalf of clients,
• Placing of crypto-assets,
• Reception and transmission of orders for crypto-assets on behalf of clients,
• Advice on crypto-assets,
• Portfolio management on crypto-assets,
• Transfer services for crypto-assets on behalf of clients.

MiCAR became applicable to CASPs as from 30 December 2024.

No person shall provide crypto-asset services, within the Union, unless that person is:

• a legal person or other undertaking that has been authorised as crypto-asset service provider in accordance with Article 63 MiCAR; or
• a credit institution, central securities depository, investment firm, market operator, electronic money institution, UCITS management company, or an alternative investment fund manager that is allowed to provide crypto-asset services pursuant to Article 60 MiCAR.

Entities seeking a CASP licence shall first assess the type of application to be made:

• Notification of the intention to provide crypto-asset services in accordance with Article 60 MiCAR: This applies to the following entities:
  • Entities that belong to the categories of financial entities that are listed under Article 60 MiCAR (i.e. credit institutions, central securities depositories, investment firms, market operators, electronic money institutions, UCITS management companies, alternative investment fund managers) when providing certain crypto-asset services listed under the same article that are deemed equivalent to the services and activities for which they are authorised under relevant EU law.
• Application for authorisation as a CASP in accordance with Article 62 MiCAR: This applies to the following entities:
  • Entities that do not belong to the categories of entities listed under Article 60, as well as
  • Entities that belong to the categories of entities listed under Article 60 when providing crypto-asset services that are not deemed equivalent to the services and activities for which they are authorised under relevant EU law.

Once the type of application has been determined, the entity may contact the CSSF by referring to the following contact points:

• Entities supervised by the CSSF are invited to contact their usual point of contact/réviseur.
• Entities not supervised by the CSSF may contact ipig@cssf.lu.

Before submitting an application file for a CASP licence to the CSSF, entities are invited to:

• Refer to the relevant regulatory framework (i.e. RTS, ITS, Guidelines, CSSF circulars, etc.) available on ESMA’s website or located in the documentary section at the bottom of this page in order to take note of the information that will be required during the application procedure;
• Read carefully the section ‘Important notes on the qualification of crypto-assets’ on the MiCA webpage of the CSSF website.

The initial contact generally starts with a meeting at the CSSF aiming to present the applicant and its project.

In order to ease the discussions, the entity is invited to provide the CSSF with precise information on the business model and the services that will be provided in Luxembourg. To that end, we request to be provided with a detailed description of the:

• Business plan containing an exact description of the crypto-asset services to be provided;

• Diagrams illustrating the role of the applicant in the provision of crypto-asset services, detailing the different types of accounts and/or wallets involved in the transactions and transfers;

• Specific explanations concerning the business partners involved in the applicant’s business model (e.g. intermediaries, third parties), including business partners to which clients will be referred for the provision of additional services, detailing their role and their contractual relations with the applicant.

In case the applicant submits a formal application file for authorisation or notification to the CSSF, it must include all the documents and information required by the relevant regulatory framework.

The application file for authorisation or notification shall exclusively be provided to the CSSF in electronic form via the MFT (Managed File Transfer) system of the CSSF, for which the required link will be provided to the applicant by the CSSF (upon request).

The CSSF then examines the application file for authorisation or notification, and communicates with the applicant via email, letter, conference calls or face to face meetings as appropriate.

After the authorisation has been granted or the notification has been completed, the authorised/registered entity is published in the national public register maintained by the CSSF and the electronic central register maintained by the ESMA.

• Data requested in this application file for authorisation or notification is needed for the assessment of the application and will be treated by the CSSF in accordance with the professional secrecy obligations set out in Regulation (EU)2023/1114, without prejudice to applicable Union law and national requirements and procedures on the exercise of the right to access, rectify, cancel or oppose.
• When providing annexes, the applicant should follow the numbering indicated in the application file and provide an inventory of the documents provided and the sections of the application file they are related to. The applicant should only provide documents in a usable format, which enables the “search” and “copy-paste” functionalities. For the financial forecasts, it implies the provision of spreadsheets.
• When making reference to the annexes, the applicant should ensure to specify the relevant section/sentence of the annex.
• The information submitted by the applicant should be true, accurate, complete, not misleading and up-to-date.
• To allow the CSSF to assess whether changes to the information provided in the application file for authorisation or notification may affect the procedure, applicants shall communicate such changes without undue delay.
• Should the CSSF require clarifications on the information that has been submitted, the applicant should provide such clarification without delay.

Pursuant to Article 59(7) MiCAR, CASPs authorised in Luxembourg are allowed to provide services in other Member States of the EU or in other States party to the EEA Agreement after having completed the following notification procedures:

• Notification under the freedom of establishment by establishing a branch in another Member State of the EU or in another State party to the EEA Agreement, or
• Notification under the freedom to provide services in another Member State of the EU or in another State party to the EEA Agreement.

Changes to initial notifications, as well as the termination of cross-border activities, have also to be filed with the CSSF.

Entities authorised in the EU/EEA that intend to exercise their activities in Luxembourg under the freedom of establishment or under the freedom to provide services are required to complete the necessary formalities with their Home State authority which will notify the CSSF. The same holds true for changes to the initial notification.