Earlier this month we highlighted the new registration and governance requirements for virtual asset service providers (VASPs) introduced by the law of 25 March 2020 establishing a centralized electronic data research system with respect to payment accounts and bank accounts identified by an IBAN number as well as safe deposit boxes held by credit institutions in Luxembourg (the Law).

The deadline for registration is short for existing VASPs and must be done online. Providers should not underestimate the level of detail required and need to ensure that they have appropriate written internal policies in place. Key information regarding senior management and board members is also required.

New obligations for VASPs: recap

VASPs falling within the scope of the Law must be registered with a register established by the Luxembourg financial regulator, the Commission de Surveillance du Secteur Financier (CSSF) and published on the CSSF’s website. The providers must send a registration request to the CSSF, together with supporting information and documentation. VASPs must also comply with new governance requirements with respect to their ultimate beneficial owners (UBOs) and the individuals exercising management functions, including requirements with respect to reputation and professional experience.

AML compliance required

VASPs now fall within the scope of the AML Law1 and are expected to be fully compliant with all applicable anti-money laundering (AML) and counter-terrorist financing (CTF) obligations in order to be registered. As “professionals” within the meaning of the AML Law, VASPs are in particular required to perform an AML/CTF risk assessment, perform initial and ongoing customer due diligence, put in place policies, procedures and controls to manage and mitigate risks, have an appropriate internal organisation and cooperate with competent authorities where required.

The registration procedure in practice

VASPs already providing in-scope services as of 30 March 2020 must (i) promptly notify the CSSF by email, (ii) submit a registration file to the CSSF, and (iii) be compliant with the professional obligations under the AML Law. VASPs offering or intending to offer in-scope services as from 30 March 2020 must ensure compliance with the AML Law and register with the CSSF prior to offering the relevant services.

In terms of process, the CSSF expects the registration procedure to typically start with a meeting at the CSSF’s premises, followed by the submission of the request for registration together with all required documents. The registration can only be submitted electronically via the CSSF’s Managed File Transfer system.

Required documentation

The CSSF published the application form to be used for the registration, as well as several forms of declarations of honour for the UBOs and persons responsible for management. The application form lists all the information and documents that must be provided by applicants to support their registration request, which includes corporate documents, information on key individuals, information about the business, strategy and services, information about the applicant’s AML/CTF framework and IT systems, and details about outsourcing arrangements.

Applicable deadlines

VASPs which were already offering in-scope virtual asset services as of 30 March 2020 must submit their registration file as soon as possible and at the latest for 30 May 2020.

Next steps for VASPs

VASPs which are established in Luxembourg or which provide their services in Luxembourg should:

  • assess whether they fall within the definition of “virtual asset service provider” set out in the AML Law;
  • ensure that their internal governance arrangements meet the conditions set out in the Law;
  • assess their AML/CTF framework; and
  • prepare the relevant documentation for a registration filing with the CSSF.

The registration procedure is similar, in some respects, to other regulatory applications such as changes of control or license applications.

Please feel free to contact us should you need assistance with the registration procedure. 


1 Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended