COREDO – EU Legal & Compliance Services Expert legal consulting, financial licensing (EMI, PSP, CASP under MiCA), and AML/CFT compliance across the European Union. Headquartered in Prague, we provide seamless regulatory solutions in Germany, Poland, Lithuania, and all 27 EU member states.
Gregory Lutsenko
03.09.2025 | 6 min read
Updated: 15.10.2026
Since 30 December 2024, the MiCA Regulation has applied throughout the EU, and crypto businesses in Luxembourg operate under its rules. The former national VASP registration no longer accepts new applicants: the law of 6 February 2025 repealed Article 7-1 of the 2004 law. The transitional period for already registered VASPs ended on 1 July 2026. Today, a crypto company with its registered office in Luxembourg requires CASP authorisation granted by the CSSF.
Why consider Luxembourg for launching a crypto company? A CASP authorisation obtained here allows you to provide services throughout the EU. This opportunity also comes with challenges: a complete application file under MiCA, checks on managers and shareholders, and strict AML/CFT requirements. Below I explain what each of these requirements means for your project.
In this article, I, Nikita Veremeev, founder of COREDO, explain how to obtain a crypto license in Luxembourg under MiCA rules. You will learn which services require authorisation, how much capital is needed and how the CSSF reviews an application. I will also explain what changed for former VASPs after the end of the transitional period.
CASP Crypto License and Cryptocurrency Regulation in Luxembourg
A license for cryptocurrency activities in Luxembourg today means authorisation as a crypto-asset service provider (CASP) under Regulation (EU) 2023/1114. The general framework of cryptocurrency regulation in the EU is set by MiCA, and in Luxembourg the Commission de Surveillance du Secteur Financier (CSSF) is responsible for applying it.
The Role and Functions of the CSSF
Luxembourg, one of the first EU countries to implement comprehensive cryptocurrency regulation through the Virtual Asset Service Provider (VASP) institution. The regulator is the Commission de Surveillance du Secteur Financier (CSSF), responsible for overseeing all cryptocurrency companies and strictly adhering to EU directives, including PSD2 (Directive 2015/2366) for payment institutions and EMD2 (Directive 2009/110/EC) for EMI.
This is how Luxembourg regulated crypto businesses before MiCA. Today the basis is different: the law of 6 February 2025 designated the CSSF as the competent authority under the MiCA Regulation. The CSSF reviews authorisation applications, supervises CASPs and imposes sanctions. If a company provides crypto-asset services without authorisation, the CSSF may order it to cease the activity immediately and without notice. In COREDO's experience, the key advantage of Luxembourg is its transparent and predictable regulatory environment.
Services Requiring CASP Authorisation
CASP authorisation is required for any of the ten crypto-asset services listed in Article 3(1)(16) MiCA:
- Custody and administration of crypto-assets on behalf of clients (custodial services)
- Operation of a trading platform for crypto-assets
- Exchange of crypto-assets for funds or for other crypto-assets
- Execution, reception and transmission of client orders, and placing of crypto-assets
- Advice, portfolio management and transfer services for crypto-assets on behalf of clients
The COREDO team's experience has shown that even with a narrow range of services, such as custody or exchange only, obtaining a license is mandatory. Today this means CASP authorisation, and without it a company can neither operate legally nor access banking services. The exception is banks, investment firms and certain other financial institutions: they may provide crypto-asset services under Article 60 MiCA.
Advantages of CASP Authorisation in the EU
Cryptocurrency services license holders under MiCA have one main advantage: the right to provide services throughout the EU (Article 59(7)). No new authorisation is needed to operate in another EU country: it is enough to notify the CSSF under Article 65. Within 10 working days, the CSSF passes this information to the host countries, ESMA and EBA. You may start operating there once the CSSF reports the transmission, and at the latest from the 15th calendar day after the notification.
Keep in mind that this right rests on the authorisation in Luxembourg. If the CSSF withdraws the authorisation, it notifies ESMA and the host countries without undue delay (Article 64(3) MiCA).
Registering a Crypto Company in Luxembourg
Registering a crypto company in Luxembourg is the first step: the CASP authorisation application is filed by a legal entity that already exists. MiCA requires a CASP's registered office to be in a country where the company provides at least part of its services. The place of effective management must be in the EU, and at least one director must be resident in the EU (Article 59(2)).
Step-by-Step Crypto Company Registration
Choose the legal form in advance: in Luxembourg, COREDO registers, among others, SA and SARL companies. Remember that the company's share capital and the capital required under MiCA are different requirements.
The step-by-step procedure is as follows:
- Reserving the company name and preparing the articles of association.
- Registering the legal entity in the Luxembourg Trade and Companies Register (Registre de Commerce et des Sociétés, RCS).
- Opening a bank account for paying in the share capital.
- Appointing directors (at least one resident in the EU), shareholders and a compliance officer.
- Preparing the authorisation file under Article 62(2) MiCA: programme of operations, governance arrangements, AML/CFT policy, ICT documentation.
- Submitting the CASP authorisation application to the CSSF.
In COREDO's experience, a clear sequence of actions and preparing documents in advance noticeably speed up the process.
Corporate Structure: Requirements
The CSSF checks management and shareholders under MiCA rules. Members of the management body must be of sufficiently good repute and have the appropriate knowledge, skills and experience. Shareholders with qualifying holdings must prove that they are of sufficiently good repute (Article 62(2)(g)–(h)). We advise appointing in advance a compliance officer responsible for implementing and controlling AML/KYC procedures.
In one of COREDO's cases, the client had to revise the shareholder structure to meet the CSSF's transparency requirements and avoid nominal holders. This approach reduces the risk of license denial and simplifies subsequent interactions with banks.
A transparent shareholder structure and effective compliance noticeably increase the chances of authorisation and of further operations on the market. Next, let us look at the minimum capital requirements.
Minimum Capital to Start a Business
The minimum capital of a CASP depends on its class of services under Annex IV MiCA:
- Class 1 — EUR 50,000: execution, reception and transmission of orders, placing, transfer services, advice, portfolio management.
- Class 2 — EUR 125,000: class 1 services, plus custody and exchange of crypto-assets for funds or other crypto-assets.
- Class 3 — EUR 150,000: class 2 services, plus operation of a trading platform for crypto-assets.
This is the floor. Under Article 67(1) MiCA, a CASP must always hold prudential safeguards of at least the higher of two amounts: its class minimum or one quarter of last year's fixed overheads. A new company calculates this quarter from the projected overheads for the first 12 months submitted with its application. The forms of safeguards are listed in Article 67(4), and own funds are among them. COREDO's practice shows: the more detailed the business plan, the higher the chance of approval and successful business launch.
Crypto License in Luxembourg: Requirements
The requirements for CASPs are the same in all EU countries: they are set by Title V of the MiCA Regulation. The CSSF checks that the applicant meets them in full and only then grants authorisation.
Documents Required for the Application
An application to the CSSF must contain all the information listed in Article 62(2) MiCA. The main items:
- Name, legal form and articles of association of the company
- Programme of operations: which crypto-asset services, and where and how you will market them
- Proof of prudential safeguards under Article 67
- Description of governance and internal control, including money laundering risks and the business continuity plan
- Proof of the repute, knowledge and experience of management, and information on shareholders with qualifying holdings
- Technical documentation of ICT systems and security arrangements
- Procedures for segregating client assets and handling complaints
The COREDO team recommends preparing and structuring all documents in advance to minimize delays during the Due Diligence stage.
AML/KYC: What It Is and Why It's Needed
Since 10 February 2025, CASPs have been expressly named in the law of 12 November 2004 on the fight against money laundering and terrorist financing. This law extends its obligations to them (Article 2(1), point 20). For a CASP this includes:
- Risk assessment and customer due diligence based on a risk-based approach
- Specific measures for transfers to and from self-hosted addresses (Article 7-1bis of the 2004 law)
- Transmitting originator and beneficiary information with crypto-asset transfers under Regulation (EU) 2023/1113
- Enhanced checks of third-country respondents in correspondent relationships (Article 3-2(3bis))
This is not a formality: if a CASP has no effective systems to prevent money laundering, the CSSF must withdraw its authorisation (Article 64(1)(f) MiCA).
COREDO's experience has shown that a preliminary audit of AML/KYC procedures can identify weaknesses and prepare the company for CSSF checks.
Director or Manager Check
All members of the management body undergo a fit and proper assessment. If management poses a threat to sound management or exposes the company to a serious risk of money laundering, the CSSF must refuse authorisation (Article 63(10)). The CSSF assesses:
- The absence of criminal records and penalties, including for AML/CFT breaches and fraud
- The knowledge, skills and experience to manage a CASP
- The commitment of sufficient time to perform their duties
In one of COREDO's projects, the client had to undergo additional due diligence to confirm work experience with digital assets: this became a decisive factor for license approval.
Opening a Bank Account for a Crypto Business in Luxembourg
Opening a bank account for a crypto business in Luxembourg: an important step to start operations in this jurisdiction with high financial services regulation standards. Before delving into details, it's vital to understand the specific requirements Luxembourg banks impose on crypto companies and what challenges the process might entail.
Bank Requirements for Crypto Companies
Opening a bank account for a crypto company in Luxembourg is one of the most challenging stages. Banks require:
- A complete set of incorporation documents
- A detailed business plan and a description of sources of funds
- An elaborate AML/KYC policy
- Confirmation of corporate structure transparency
COREDO's practice confirms: banks conduct their own due diligence and may deny account opening without explanation if there are doubts about transparency or funds' sources.
How to Communicate with Banks: Tips and Recommendations
To minimize rejection risks, we recommend:
- Choosing banks with experience in working with crypto companies
- Providing maximum transparency about beneficiaries and sources of funds
- Using outsourcing compliance for process preparation and support
- Engaging in communication through professional consultants
In one of COREDO's cases, a client successfully opened an account at a local bank within 3 weeks due to a thoroughly prepared compliance package and negotiation support.
Taxes and Financial Monitoring of Crypto Business in Luxembourg
Taxes and financial monitoring of crypto businesses in Luxembourg are key issues for any company working with digital assets in this jurisdiction. Particular attention is paid both to the tax obligations of crypto companies and to strict requirements for financial monitoring and disclosure.
Taxes for Crypto Companies
A crypto company's taxes are governed by general Luxembourg tax law, not by MiCA. According to the tax administration, from 2025 the nominal tax burden of a company in the commune of Luxembourg is made up as follows:
- Corporate income tax (IRC) — 16%
- Employment fund surcharge — a further 1.12%
- Municipal business tax — 6.75%, for a total of 23.87%
COREDO's tax optimization solutions include choosing the optimal corporate structure, using international tax treaties to avoid double taxation, and smartly structuring income streams.
Financial Monitoring and Reporting
Financial monitoring is ongoing work for a CASP and includes:
- Bookkeeping and financial reporting
- Keeping records of orders and transactions, which the CSSF may request at regular intervals
- Compliance with data protection requirements (GDPR)
- Reporting on financial sanctions and suspicious transactions
IT infrastructure requirements are especially important for crypto companies: the CSSF already reviews the technical documentation of ICT systems and security arrangements in the application (Article 62(2)(j) MiCA).
Careful compliance with these requirements is the basis for obtaining and keeping a crypto license in Luxembourg.
Crypto License in Luxembourg: Timeframes and Costs
A crypto license in Luxembourg opens access to one of the most developed and stable financial markets in Europe. Yet obtaining it involves high regulatory standards and a thorough review by the CSSF. Let's look at the timeframes MiCA sets and at the costs a future crypto business owner should expect.
Licensing Timeframe and Cost
The review timeframes are set by Article 63 MiCA. The CSSF acknowledges receipt of an application within 5 working days and checks its completeness within 25 working days. A decision on a complete application is taken within 40 working days. A request for additional information may suspend this period by no more than 20 working days. The costs include:
- Minimum capital for the CASP class — EUR 50,000, EUR 125,000 or EUR 150,000
- Preparing the file under Article 62(2), the ICT documentation and the AML/CFT policies
- Setting up the company and an office in Luxembourg, where part of the services is provided
COREDO's experience shows: investments in quality document preparation and compliance pay off by speeding up the process and reducing rejection risks.
Risks and Ways to Minimize Them
Key risks:
- Authorisation refused due to insufficient compliance or an opaque structure
- Bank refusal to open an account
- Operating without authorisation: the CSSF may order the activity to cease immediately
- Consequences of AML breaches: fines and withdrawal of authorisation
To minimize risks, COREDO recommends conducting a preliminary audit, using outsourcing compliance, and regularly updating internal policies.
Business Scaling and International Market Entry
A CASP authorisation in Luxembourg allows scaling a crypto business within the EU without re-licensing. This is especially relevant for companies aimed at international expansion. In one of COREDO's projects, a client managed to enter the markets of Germany, France, and the Netherlands within 6 months after obtaining the license.
Cryptocurrency Regulation in Luxembourg
Cryptocurrency regulation in Luxembourg today consists of the directly applicable MiCA Regulation and the law of 6 February 2025, which embedded the Regulation in national law. The law gave the CSSF supervisory and investigatory powers and introduced administrative sanctions for breaches of MiCA.
Technology Integration
For decentralised systems without an issuer or a CASP, the MiCA Regulation provided for a separate Commission report on whether they should be regulated (Article 142(2)(a)). If your product combines DeFi with custody or exchange for clients, these are crypto-asset services, and CASP authorisation is required.
The COREDO team implemented a project on integrating DeFi protocols with custodial services, which allowed the client to offer unique products while fully complying with CSSF requirements.
Changes in Regulation: What to Expect?
The main change has already happened. Until 30 December 2024, crypto companies registered with the CSSF as VASPs under Article 7-1 of the 2004 law, and the law of 6 February 2025 repealed that article. Registered VASPs could operate until 1 July 2026 or until the CSSF decided on their application for CASP authorisation. That transitional period has ended, and crypto-asset services may no longer be provided without CASP authorisation. Companies without the required authorisation must, as the CSSF requires, wind down their activities in the EU in an orderly manner.
Practical Tips for Entrepreneurs
Practical tips for entrepreneurs will help you avoid typical mistakes at the start and approach your business launch wisely. In this section, you will find specific recommendations on how to obtain a license and open a business, considering all major requirements and registration stages.
How to Obtain a License and Open a Business
- Define your crypto-asset services and your CASP class under Annex IV MiCA.
- Set up a company in Luxembourg with its place of management in the EU and a director resident in the EU.
- Prepare a complete file under Article 62(2) MiCA, including the programme of operations and the AML/CFT policies.
- Put in place the prudential safeguards under Article 67 before applying.
- Communicate with banks through professional consultants.
Corporate Governance and Compliance: Best Practices
- Maintain transparency in corporate structure and sources of funds.
- Implement regular internal audits and risk assessments.
- Ensure GDPR compliance and data protection standards.
- Develop and update AML/KYC policies in line with the 2004 law and the FATF recommendations.
Licensing Checklist
| Stage/Requirement | Documents/Actions | Responsible | Timeframes | Notes |
|---|---|---|---|---|
| Setting up the company (SA or SARL) | Articles of association, incorporation documents | Lawyer | Before applying | Office in Luxembourg, Article 59(2) MiCA |
| Opening a bank account | KYC, business plan, articles of association | Director | Before applying | Needed for paying in the capital |
| Application file | Information under Article 62(2), AML/CFT policies, ICT documentation | Lawyer and compliance officer | Before applying | Capital under Article 67 and Annex IV |
| Filing the application with the CSSF | Complete application file | Director | 25 working days for the completeness check | Article 63(2) MiCA |
| CSSF decision | Answers to CSSF requests | Lawyer and director | 40 working days from the complete application | A request for information suspends the period by up to 20 working days |
In conclusion, I would like to emphasize: a license for cryptocurrency activities in Luxembourg today means CASP authorisation under MiCA. It opens access to the entire EU market, but it also means a significant responsibility to the regulator, banks, and investors. COREDO's experience shows: success in this jurisdiction can only be achieved with a systematic approach to compliance, transparency, and strategic planning. If you are ready for new opportunities and want to minimize risks: the COREDO team is always prepared to offer a solution based on deep market knowledge and practical experience in international consulting.