3 minutes read
Early interactions with the Luxembourg Commission de Surveillance du Secteur Financier (CSSF) show that, irrespective of the route chosen, significant emphasis is placed on the quality, completeness and consistency of the information provided. In addition, third-country groups seeking to access the EU market through Luxembourg should carefully assess the CSSF’s expectations regarding local substance, governance arrangements and the organisation of crossborder activities at an early stage. With an increasing number of CASP licences now being granted in Luxembourg, developments in this area have become a subject of particular interest for market participants.
CSSF authorisation versus CSSF notification: which option is available to each market player?
Under MiCAR, firms wishing to provide crypto-asset services in Luxembourg can either obtain a full CASP authorisation or, where eligible, rely on the MiCAR notification procedure. The CSSF is the competent authority responsible for both routes. A full CASP authorisation is required for entities that do not already hold a qualifying financial licence. This option involves a comprehensive application process, requiring firms to demonstrate compliance with MiCAR’s governance, organisational, ICT, AML/CFT and prudential requirements. Once authorised, a Luxembourg CASP may provide the approved cryptoasset services across the EU under the MiCAR passporting framework.
The notification procedure provides a simplified alternative for certain regulated entities, including credit institutions, investment firms, electronic money institutions, UCITS management companies and AIFMs. Rather than obtaining a separate CASP licence, these entities may notify the CSSF of their intention to provide specific crypto asset services that are linked to or equivalent to their existing regulated activities. While generally faster and less burdensome than a full authorisation, the notification route is only available for certain services and remains subject to the limitations set out in MiCAR. Firms should therefore carefully assess whether their intended crypto-asset activities fall within the scope of the notification regime or require a full CASP authorisation.
Initial contact with the CSSF
Before formally submitting a CASP authorisation application or notification, firms are encouraged to engage with the CSSF at an early stage. Entities already supervised by the CSSF should typically approach their usual supervisory contact, while non-supervised entities may contact the CSSF through its dedicated MiCAR channel. In practice, the process generally begins with an introductory meeting during which the applicant presents its business model, the cryptoasset services it intends to provide and its operating structure. The CSSF expects firms to demonstrate a clear understanding of how their activities fit within the MiCAR framework and to provide sufficient detail to facilitate the regulatory assessment.
To support these initial discussions, applicants should be prepared to provide a detailed business plan, transaction and wallet flow diagrams, and a clear explanation of the role of any thirdparty providers, intermediaries or group entities involved in the operating model. As a result, thorough preparation and clear documentation from the outset can help streamline the application process and address potential regulatory concerns at an early stage.
Applications for CASP authorisations and notifications must be submitted electronically via the CSSF’s Managed File Transfer (MFT) platform. Access to the platform is provided to applicants by the CSSF upon request. Once submitted, the CSSF reviews the documentation uploaded and engages with applicants through written correspondence, calls and meetings as appropriate throughout the assessment process. To date, the CSSF has largely implemented the MiCAR framework through the adoption of applicable EU regulatory and implementing technical standards, guidelines and recommendations, but has not issued material Luxembourg-specific guidance for CASP applicants. Firms are therefore expected to closely monitor and comply with the evolving EU regulatory framework, which remains the primary reference point of the Luxembourg regulator for both authorisation applications and notifications.
CASP notification: process and required documentation
While the notification regime is intended to be more streamlined than a full CASP authorisation, it should not be regarded as a mere formality. The notification must be submitted to the CSSF at least 40 working days prior to the intended commencement of the relevant cryptoasset services. The CSSF expects notifications to be supported by clear, comprehensive and well-substantiated documentation and may request additional information where necessary. Upon receipt of a notification, the CSSF has up to 20 working days to assess whether the file is complete. Where additional information is requested, the 40 working day notification period is suspended (once, for a period of up to 20 working days) until the requested information has been provided.
In practice, a CASP notification requires detailed information on the applicant’s business model, organisational structure and the crypto-asset services it intends to provide. This includes, among other things, a description of the proposed services and relevant crypto-assets, the target markets and client base, any changes to the governance and control framework required to accommodate the proposed crypto-asset activities, the availability of adequate human and financial resources, and the firm’s ICT, cybersecurity and operational resilience arrangements, including compliance with DORA where applicable.
The CSSF also expects firms to demonstrate how the proposed crypto-asset services fall within the scope of their existing regulatory permissions and to submit policies and procedures that adequately address the requirements of MiCAR. In many cases, this will require existing frameworks to be updated to reflect the new activities. Depending on the services concerned, firms may need to adopt or revise arrangements relating to conflicts of interest, safeguarding of client assets, outsourcing, operational resilience, AML/CFT controls and business continuity planning. Firms should therefore ensure that their notification package clearly evidences both operational readiness and compliance with the applicable MiCAR requirements before submitting it to the CSSF.
CASP authorisation application: process and required documentation
Entities that do not already hold a regulated status allowing them to rely on the notification regime, or that intend to provide cryptoasset services beyond the scope of that regime, must obtain a full CASP authorisation from the CSSF before commencing their activities. This is a significantly more extensive process than a notification and requires the submission of a comprehensive application file.
The authorisation process is subject to statutory timelines. Upon receipt of an application, the CSSF has up to 25 working days to assess whether the file is complete. Where information or documentation is missing, the CSSF may request additional information, in which case the assessment period is suspended until the applicant has provided the requested materials. Once the application has been deemed complete, the CSSF has up to 40 working days to carry out its substantive assessment of the application. In practice, however, applicants should factor in several months for their application process, as multiple rounds of questions, information requests and follow-up discussions with the CSSF are often required before a final decision is reached.
A CASP authorisation application must address all aspects of the proposed business and demonstrate the applicant’s ability to comply with the organisational, prudential and conduct requirements of MiCAR. Applicants are expected to provide, among other things:
- corporate and organisational information, including ownership structure, group organisation and governance arrangements;
- a detailed programme of operations describing the cryptoasset services to be provided, the target market, business strategy and financial projections;
comprehensive governance and internal control frameworks, including the allocation of responsibilities, risk management arrangements and compliance controls; - information on the suitability, experience and good repute of members of the management body and other key function holders;
- evidence of compliance with applicable prudential requirements, including own funds requirements where relevant;
- detailed ICT, cybersecurity and operational resilience arrangements, including compliance with DORA where applicable;
- policies and procedures addressing AML/CFT, conflicts of interest, outsourcing, complaints handling and business continuity; and
- where relevant, arrangements for the safeguarding of client cryptoassets and funds, custody processes and other servicespecific controls.
Depending on the exact type of cryptoasset services intended to be offered, additional information or documentation may be required as part of the CASP application process.
Particular attention is generally paid to local substance, operational resilience and the applicant’s ability to effectively manage the risks associated with crypto-asset activities. Applicants should therefore ensure that the application file clearly demonstrates that the necessary resources, expertise, systems and controls are already in place, or will be in place in Luxembourg, before commencing activities.
Practical CSSF expectations and points of attention
In practice, the Luxembourg regulator applies strict quality standards to submitted files. Although MiCAR is an EU harmonised framework and Luxembourg has not, to date, introduced material Luxembourg specific “gold-plating” for CASPs, applicants should not underestimate the level of detail expected by the CSSF. Notifications and authorisation files must be complete, transparent and well substantiated, with explanatory drafting rather than mere crossreferences to internal policies. The CSSF will assess whether the proposed operating model is genuinely sound and compliant in practice.
A key area of focus is the operational organisation of the proposed crypto-asset services. Applicants should be prepared to provide clear process descriptions, transaction and wallet flowcharts, reporting lines and responsibility matrices demonstrating how the services will operate in practice. For institutions using the notification route, MiCAR specific requirements should be carefully mapped against the existing governance, compliance, risk management, outsourcing, ICT, conflicts of interest, complaints handling and AML/CFT framework. In many cases, the preferred approach will be to update existing policies or add targeted cryptospecific supplements rather than creating a fully parallel policy framework.
The CSSF also pays close attention to thirdparty arrangements and outsourcing, whether within or outside the EU. Applicants should clearly identify all external service providers, assess whether the relevant arrangements qualify as outsourcing and ensure that DORA requirements are properly addressed. As with other Luxembourg regulated entities, outsourcing arrangements will need to be robustly documented and monitored, including from an ICT and operational resilience perspective.
For third country groups, particular attention should be paid to the overall access model to the EU market. There is no general crossborder regime allowing non-EU entities to provide cryptoasset services into Luxembourg or the EU without appropriate MiCAR authorisation or notification. Broker models, shared order book arrangements, custody models and intragroup reliance structures should therefore be carefully assessed at an early stage. ESMA’s guidance on shared order book and broker models used by global crypto groups relying on non EU execution venues should be carefully reviewed and relied upon.
Other recurring points of attention include the location and organisation of crypto-asset custody and the safeguarding and segregation of client assets. Applicants are expected to demonstrate robust arrangements in these areas to ensure compliance with MiCAR’s prudential and investor protection requirements.
Applicants should also give careful thought to Luxembourg substance. A minimal local setup is unlikely to be sufficient. In practice, the CSSF will expect staffing levels to be proportionate to the complexity, scale and risk profile of the proposed business. For more complex business models, or where an existing international client base is intended to be migrated to Luxembourg, sufficient staff and operational capacity should be in place from the outset rather than built gradually after authorisation. Prefiling discussions with the CSSF are therefore particularly important.
What should applicant firms do?
Whether pursuing a CASP authorisation or submitting a notification for a top-up, firms should invest sufficient time in preparing a robust application package that clearly articulates their business model, control framework and compliance with MiCAR requirements. Early engagement with the CSSF and careful alignment with the evolving EU regulatory framework can significantly contribute to a smoother review process.
Why Luxembourg?
The recent wave of CASP authorisations in Luxembourg, which already counts 13 authorised providers, reflects the increasing appeal of Luxembourg for crypto-asset businesses, which benefit from the country’s stable and innovation driven financial ecosystem, deep pool of international expertise, mature regulatory framework, collaborative regulator and access to the EU single market.
The presence of well established fintech and digital asset players that have chosen Luxembourg as their European base further reinforces the jurisdiction’s position as a key destination for businesses seeking MiCAR authorisation. At that stage, applicants should be prepared to present, at a minimum, the planned business model, the qualification of the crypto-asset services to be provided in Luxembourg, initial forecasts and financing information, the shareholding and governance structure, outsourcing arrangements, custody and safekeeping arrangements, any broker or shared order book model, and the AML/CFT framework. Finally, future CSSF communications may apply certain governance expectations applicable to other regulated entities by analogy (pending more dedicated guidance).
