CASP authorisation in Luxembourg — the CSSF MiCA licence, capital tiers and VASP transition
CASP authorisation in Luxembourg runs through the CSSF as the single competent authority under MiCA. The framework is Regulation (EU) 2023/1114 (MiCA), directly applicable across the EU, layered with the national Law of 6 February 2025 that designates the Commission de Surveillance du Secteur Financier as the authority for all crypto-asset authorisation, supervision and enforcement in the Grand Duchy. This piece walks through who grants what, what the dossier needs, how the VASP-to-CASP transition works, and what switches on the day the authorisation is granted.
1. Legal basis
Two instruments define the Luxembourg CASP regime — one European and directly applicable, one national and procedural.
- Regulation (EU) 2023/1114 — MiCA. The substantive rules (authorisation, capital, conduct, custody, market abuse) sit here and are identical across every member state.
- Law of 6 February 2025 — the national law designating the CSSF as the competent authority for MiCA. It was published in the Mémorial (Official Journal) on 10 February 2025 and entered into force the same day, giving the CSSF its supervisory, investigative and sanctioning powers.
- CSSF regulations, circulars and FAQ on crypto-assets, which consolidate the authority’s expectations on the dossier and on the VASP transition.
MiCA’s CASP obligations have applied since 30 December 2024. The national law arrived a few weeks later; the CSSF had already opened its pre-application channel.
2. Who grants what
Unlike France’s two-authority split, Luxembourg runs a single-desk model — the CSSF handles both the conduct and prudential sides of every crypto authorisation.
| Activity | Competent authority |
|---|---|
| CASP authorisation under Article 59 MiCA | CSSF (conduct and prudential) |
| Asset-Referenced Token (ART) issuer authorisation | CSSF |
| Electronic-Money Token (EMT) issuance | CSSF (issuer must be a credit institution or an authorised electronic money institution) |
| Prior VASP registration (legacy AML regime) | CSSF |
| AML supervision and STR reception | CSSF plus the Cellule de Renseignement Financier (CRF) via goAML |
3. The MiCA services catalogue
Article 3(1)(16) MiCA lists the crypto-asset services a CASP can be authorised to provide. The selection drives capital, conduct and custody requirements:
- Custody and administration of crypto-assets on behalf of clients
- Operation of a trading platform for crypto-assets
- Exchange of crypto-assets for funds
- Exchange of crypto-assets for other crypto-assets
- Execution of orders for crypto-assets on behalf of clients
- Placing of crypto-assets
- Reception and transmission of orders for crypto-assets
- Provision of advice on crypto-assets
- Portfolio management of crypto-assets
- Transfer services for crypto-assets on behalf of clients
4. Capital and prudential requirements
Article 67 MiCA and Annex IV set three minimum capital classes, tied to the services applied for:
- Class 1 — €50,000: reception and transmission of orders, advice, portfolio management, execution, placing, transfer services (the lightest-touch services).
- Class 2 — €125,000: custody and administration, plus exchange of crypto-assets for funds or for other crypto-assets.
- Class 3 — €150,000: operation of a trading platform.
Ongoing own funds must be the higher of the applicable floor and one quarter of the previous year’s fixed overheads. The CSSF scrutinises the fixed-overheads calculation in the dossier and expects the applicant to show how own funds are held and monitored.
5. What goes in the CSSF dossier
The MiCA application content is fixed by Article 62 and the ESMA-level technical standards. The CSSF file mirrors the EMI / PI dossier structure with crypto-specific additions:
- Programme of operations — the services in scope, the customer journey, the asset types handled.
- Business plan — three-year projections, with own-funds evolution.
- Governance map — the management body, key function holders and fit-and-proper documentation.
- Internal-control framework — risk management, compliance, internal audit.
- ICT and operational-resilience framework aligned with DORA, including the register of information on ICT third-party providers.
- Custody and segregation — for custody CASPs: the segregation model, the cold/hot wallet split, the key-management framework and any sub-custody arrangement (Article 70 MiCA).
- Market-abuse policy — the Title VI MiCA rules on insider dealing and market manipulation in crypto-assets.
- AML / CFT programme — including the Travel Rule under Regulation (EU) 2023/1113 and the self-hosted-wallet flow, with CRF/goAML connectivity.
- Complaints handling under Article 71 MiCA.
- White papers where the applicant also issues tokens.
6. The VASP-to-CASP transition
The Luxembourg transition is governed by Article 143(3) MiCA and Article 20 of the Law of 6 February 2025. The mechanics matter for sequencing:
- The transitional period runs 18 months, from 30 December 2024 to 1 July 2026, for VASPs that were registered with the CSSF before 30 December 2024.
- During that window a legacy VASP may continue its activities while it prepares and files a full CASP dossier.
- A simplified authorisation procedure is available under Article 143(6) MiCA for firms that already hold an equivalent national authorisation, reducing duplication where the CSSF already holds the relevant information.
- Missing the 1 July 2026 date means operating without authorisation — a firm that has not been granted (or at least has a complete file under assessment) cannot rely on the legacy registration beyond the window.
7. Three worked examples
The regime is mechanical, so it is easiest to see through concrete cases a Luxembourg applicant actually faces.
- Legacy exchange with custody. A firm registered as a CSSF VASP in mid-2024, offering fiat-to-crypto exchange and wallet custody. Rule: Article 143(3) plus Article 20 of the national law give it until 1 July 2026. Action: it files a Class 2 CASP dossier (€125,000 floor covers both exchange and custody) using the simplified procedure, front-loading the Article 70 segregation model and the DORA framework. Outcome: continuity of operations if the file is complete and under assessment before the window closes.
- Advisory-only newcomer. A firm launching after MiCA with no legacy registration, providing only advice and reception-and-transmission of orders — it never touches client assets. Rule: both services sit in Class 1. Action: it applies fresh for a €50,000 authorisation, with a lighter custody section because it holds nothing. Outcome: a proportionate dossier and the lowest capital floor — but full conduct, complaints and market-abuse obligations still apply.
- EMI adding a stablecoin. A Luxembourg electronic money institution wants to issue a euro-referenced token. Rule: an EMT is issued under MiCA Title IV inside the EMI licence — it is not a CASP service. Action: the firm extends its EMI authorisation with the CSSF and drafts an EMT white paper; it needs a separate CASP authorisation only if it also intends to offer custody, exchange or a trading platform. Outcome: two distinct authorisations for a firm that both issues the token and provides services around it.
8. Realistic timing
Article 63 MiCA sets a statutory 25 working days for the CSSF to confirm completeness and a further 40 working days for the substantive decision. In practice, with pre-application engagement and one or two feedback rounds, a first-time applicant should plan for six to nine months end-to-end. VASP migrants using the simplified procedure usually run shorter, because the CSSF already holds the governance and AML baseline.
9. What switches on at grant
- Travel Rule compliance on every crypto-asset transfer, under Regulation (EU) 2023/1113.
- DAC8 reporting from 2026 onwards.
- AML, tipping-off and STR obligations to the CRF via goAML.
- Market-abuse monitoring and reporting under Title VI MiCA.
- Conduct and complaints handling under Articles 66 and 71 MiCA.
- CSSF supervisory and prudential reporting.
- Passporting notifications under Article 65 MiCA where activity extends cross-border.
10. FAQ
Do I file with the CSSF or with another authority?
The CSSF only. Luxembourg runs a single-desk model, so the CSSF handles both the conduct and prudential assessment of a CASP file. The Cellule de Renseignement Financier is the FIU that receives suspicious-transaction reports, but it is not part of the authorisation.
If I hold a CSSF VASP registration, am I CASP-authorised?
No. The VASP registration was an AML-only regime. MiCA requires a fresh CASP authorisation. Article 143(3) MiCA and Article 20 of the Law of 6 February 2025 give registered VASPs a window until 1 July 2026 to obtain it while continuing to operate.
When does the Luxembourg transitional period end?
1 July 2026, for VASPs registered with the CSSF before 30 December 2024 — an 18-month window measured from the date MiCA’s CASP rules began to apply.
What is the minimum capital?
€50,000, €125,000 or €150,000 depending on the services, per Article 67 MiCA and Annex IV. Ongoing own funds must be the higher of that floor and a quarter of the prior year’s fixed overheads.
Does a Luxembourg CASP authorisation passport across the EU?
Yes. Article 65 MiCA passporting applies — the CSSF as home authority notifies the host state, which has limited grounds to react. See our branch vs Freedom of Services piece.
How does Luxembourg CASP compare to France?
The substance is identical because MiCA is directly applicable. The procedural difference is the authority architecture — Luxembourg uses the single CSSF desk, while France splits conduct (AMF) and prudential (ACPR). Luxembourg’s legacy regime was VASP registration; France’s was PSAN.
11. What to do, today
- Confirm whether your services catalogue triggers CASP authorisation, ART/EMT issuance, or both — and map each service to its Article 67 capital class.
- If you hold a CSSF VASP registration, do not assume continuity — start the CASP dossier and aim to have a complete file under assessment well before 1 July 2026.
- Build the Article 70 custody segregation, the Title VI market-abuse policy and the Travel Rule implementation as core dossier elements, not afterthoughts.
- Run pre-application engagement with the CSSF before formal submission — it is the fastest way to compress the feedback rounds.
- Plan post-grant reporting — Travel Rule, DAC8 and market-abuse monitoring switch on at grant, not later.
Related: EMI licence in Luxembourg (CSSF) · CASP authorisation in France · MiCA white paper drafting
