Registration of a virtual asset service provider (VASP)

The CSSF’s role for the Virtual Asset Service Providers registered in Luxembourg is limited to registration, supervision and enforcement for AML/CFT purposes only. The CSSF shall, in that respect, be authorised to collect fees payable by the VASPs subject to registration and AML/CFT supervision.

No persons established in Luxembourg or providing services in Luxembourg may provide virtual asset services without being registered with the CSSF as provided for in Article 7-1(1) of the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“AML/CFT Law”).

According to Articles 1(20c) and 7-1(1) of the AML/CFT Law, entities, who are established or provide services in Luxembourg, have to register with the CSSF in case they are providing one or more of the following services on behalf of or for their clients:

• exchange between virtual assets and fiat currencies, including the exchange between virtual currencies and fiat currencies;
• exchange between one or more forms of virtual assets;
• transfer of virtual assets;
• safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, including custodian wallet services;
• participation in and provision of financial services related to an issuer’s offer and/or sale of virtual assets.

Any entity, including any entity already licensed/registered by a competent authority and in particular licensed financial institutions, which already offers any of the virtual asset services described above as of 30 March 2020, has to :

• promptly notify the CSSF thereof by email (to ipig@cssf.lu);
• submit a registration file to the CSSF in order to be specifically registered as VASP as soon as possible and at the latest by 30 May 2020; and
• comply, as from 30 March 2020, with the professional obligations and the conditions described in the AML/CFT Law, as amended by the March 2020 Laws.

Any entity, including any entity already licensed/registered by a competent authority and in particular licensed financial institutions, which offers or intends to offer any of the virtual asset services described above as from 30 March 2020 has to:

• register beforehand as a VASP; and
• comply with the professional obligations and the conditions described in the AML/CFT Law, as amended by the March 2020 Laws.

The requirement of registration for applicants, who are established or provide services in Luxembourg, is without prejudice to any other licence/registration or other status required either in Luxembourg or by other European or third countries for any other activities performed by the applicant.

The registration procedure generally starts with a meeting at the CSSF premises aiming to present the applicant and its project. Depending on the activities of the project, registration as a VASP may be necessary.

In case the applicant submits a formal registration file to the CSSF for registration, it must include all the documents and information required by using the relevant forms made available on the CSSF website.

The registration file shall exclusively be provided to the CSSF in an electronic form via the MFT (Managed File Transfer) system of the CSSF, for which the required link will be provided to the applicant by the CSSF (upon request to the following email address ipig@cssf.lu). The submission of a registration file does not entail registration with the CSSF. The registration is effective upon inclusion of the applicant in the CSSF register. The CSSF then examines the registration file, by analysing it, exchanging letters and, where appropriate, organising meeting(s) with the relevant stakeholders.

The CSSF reserves the right to ask for additional information and documents during the registration process. The CSSF also reserves the right not to commence the analysis of the registration file as long as the registration file is not complete and the requested information and documents are missing.

When the CSSF has finished its analysis and a formal registration decision has been taken by the CSSF, the CSSF will complete the registration itself. After the registration has been completed, the registered entity is published in the national public register maintained by the CSSF. The fact that a VASP is entered in the register of the CSSF shall not, under any circumstance, be described in any way whatsoever as a positive assessment made by the CSSF of the quality of the services provided by the VASP. The registration, the submission of a registration and/or the CSSF AML/CFT supervision may not be invoked or used for advertising or possible solicitations for business.

If, after the registration, significant changes to the activities or to the key function holders notified upon registration occur, the registered entity has to immediately inform the CSSF in writing. The CSSF has the right to withdraw the entity from the register in case of non-compliance with certain obligations as provided for in Article 7-1(4) of the AML/CFT Law. The CSSF has several supervisory powers and has the power to impose administrative sanctions and other administrative measures as provided for in chapter 3-1 of the AML/CFT Law.