The MiCA transitional period ended on 1 July 2026, and crypto-asset service providers operating in or from Luxembourg without a valid CASP authorisation are now in breach of EU law. The CSSF, as Luxembourg's competent authority under MiCA, is empowered to take supervisory and enforcement action against non-compliant entities with immediate effect. Businesses that have not yet secured authorisation must take urgent steps to either regularise their position or cease regulated activities.
What Changed on 1 July 2026
Until 30 June 2026, crypto-asset service providers that were already operating under national frameworks – principally Luxembourg's registration regime administered by the CSSF – could continue their activities under a time-limited grandfathering arrangement introduced by the MiCA regulation. That window closed at midnight on 30 June 2026.
On 17 April 2026, ESMA issued a statement confirming that no extension to the transitional period would be granted. This removed any residual uncertainty for firms that had hoped for regulatory forbearance. A further ESMA public statement dated 23 June 2026 set out the consequences directly: unauthorised CASPs must immediately stop onboarding new clients and stop all marketing of crypto-asset services to EU clients. Their permitted activities are strictly limited to enabling existing clients to sell or transfer their assets, close open positions, and otherwise wind down their exposure in an orderly manner.
Operating outside these constraints – for example, continuing to accept new clients or promoting services – now constitutes an unlawful provision of crypto-asset services to EU clients.
Luxembourg's Specific Position
Luxembourg occupies a distinctive place in the European crypto landscape. A significant number of entities holding crypto-related assets or conducting digital-asset operations are structured through Luxembourg holding vehicles, including SOPARFIs, and registered with the Registre de Commerce et des Sociétés (RCS Luxembourg). For these structures, MiCA compliance is not merely an operational question: it intersects directly with corporate governance, beneficial ownership obligations, and ongoing AML/CFT requirements imposed by Luxembourg law.
The CSSF has been the competent authority for MiCA authorisation in Luxembourg since the regulation became directly applicable. Firms wishing to apply for a CASP licence must submit to the CSSF and satisfy its requirements on governance, capital adequacy, organisational structure, and – critically – AML/CFT controls. The authorisation procedure before the CSSF involves detailed documentation and, in practice, a meaningful review period. Any entity that has not yet commenced this process faces a substantial gap between its current status and authorisation.
For international groups with Luxembourg entities, the structure of the applicant matters. An entity incorporated in Luxembourg and registered with the Tribunal d'arrondissement – Luxembourg's court of first instance responsible for commercial registrations – will be assessed as a Luxembourg CASP applicant, with all associated obligations falling under Luxembourg national law and CSSF supervision.
According to data from the ESMA register, 325 CASPs had received full authorisation across the EU as of 12 August 2026, up from approximately 210 by May 2026. This growth reflects the acceleration of applications ahead of the deadline, but it also confirms that a very large number of previously active market participants remain outside the authorised perimeter.
If you operate a crypto-asset business in or through Luxembourg and are uncertain whether your entity requires a CASP licence, our team can assist you in assessing your regulatory position. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Who Is Affected in Luxembourg
MiCA's definition of crypto-asset services is broad. The following categories of business are most directly affected in the Luxembourg context:
- Crypto exchanges and trading platforms serving EU retail or professional clients, regardless of where their servers or parent entities are located.
- Custodians and wallet providers holding crypto-assets on behalf of clients established in Luxembourg or elsewhere in the EU.
- Portfolio managers and advisers providing investment advice or discretionary management in relation to crypto-assets.
- Token issuers that also provide ancillary services falling within MiCA's service definitions.
- Luxembourg-incorporated holding structures (including SOPARFIs) that have been used to channel or manage crypto-related activities and which, on examination, perform regulated CASP functions rather than purely passive holding.
- Third-country firms that actively target EU clients from outside the EU and which do not benefit from a reverse solicitation exemption – a narrow carve-out that regulators have consistently interpreted restrictively.
AML/CFT compliance is a threshold requirement for CASP authorisation and for ongoing operation. Luxembourg's transposition of the relevant EU directives imposes specific obligations regarding beneficial owner identification, transaction monitoring, and suspicious transaction reporting. Non-compliance on the AML/CFT side is an independent ground for supervisory action, entirely separate from the MiCA authorisation question. For more detail on how these obligations interact in practice, see our overview of AML compliance in Luxembourg.
Immediate Action Items for International Companies
Given the end of the transitional period, the following steps should be treated as urgent:
- Conduct a service-by-service MiCA classification review. Determine which of your current activities fall within the MiCA definition of crypto-asset services. Some activities – for example, purely intra-group transfers or certain treasury functions – may fall outside the regulated perimeter, but this analysis must be documented.
- Assess your authorisation status. If your entity holds a CSSF registration under the prior national framework but has not received a MiCA CASP authorisation, that registration no longer provides a lawful basis for providing crypto-asset services. Verify your status on the ESMA register.
- Implement the ESMA wind-down protocol if you are unauthorised. As directed in ESMA's statement of 23 June 2026: stop new client onboarding immediately, cease marketing, and limit activities to orderly wind-down. Document these steps contemporaneously – this documentation will be relevant to any future CSSF engagement.
- Prepare or accelerate your CASP licence application. If you intend to continue operating, submit your application to the CSSF without delay. Assemble governance documentation, AML/CFT policies, capital evidence, and details of your beneficial ownership structure. Luxembourg's detailed procedural requirements mean that incomplete applications cause significant delay.
- Consider passporting strategy in parallel. Once a Luxembourg CASP authorisation is obtained, services can be passported to other EEA member states through a notification procedure. Early planning of passporting scope can reduce the regulatory surface area that must be managed across jurisdictions. Our analysis of MiCA passporting strategy from Luxembourg sets out the practical steps involved.
Enforcement Risk Is Real
The CSSF has broad supervisory powers under Luxembourg law, including the ability to issue cease-and-desist orders, impose administrative sanctions, and – in cases of serious breach – refer matters for criminal prosecution. The combination of an explicit ESMA public statement and the hard 1 July 2026 deadline removes any argument that a firm was operating in good faith under transitional provisions. Continued non-authorised activity after this date is legally straightforward to characterise as unlawful, which lowers the threshold for enforcement action.
International groups that have Luxembourg entities in their structure should also consider reputational and group-wide implications. A CSSF enforcement action against a Luxembourg subsidiary can affect licensing proceedings in other jurisdictions and may trigger disclosure obligations to other regulators within the group's footprint.
For a full assessment of your Luxembourg entity's position under MiCA – including service classification, authorisation readiness, and AML/CFT alignment – please reach out to our team at info@ferrazwhitmore.com or through our contacts page. We work with international groups across the full authorisation lifecycle, from initial scoping through to CSSF submission and beyond. Further information on the Luxembourg CASP licensing process is available at our MiCA licensing service page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.