Since 1 July 2026, the MiCA transitional period has ended across the EU, and crypto-asset service providers operating from or into Luxembourg must hold a full CASP authorisation issued by the Commission de Surveillance du Secteur Financier (CSSF) or a valid MiCA passport from another Member State. Luxembourg's position as an established fund and fintech domicile makes it one of the more competitive bases for CASP authorisation and EU-wide passporting, but the regulatory path is demanding and the consequences of non-compliance are now immediate. Firms that have not yet secured authorisation face strict constraints on their activities under ESMA's guidance of 23 June 2026.
Why Luxembourg Remains a Strategic Jurisdiction for CASP Authorisation
Luxembourg has long attracted financial intermediaries seeking an EU licence with passporting reach, and MiCA reinforces that logic. The CSSF brings deep experience in supervising payment institutions, investment firms and AIFMs, and has developed supervisory frameworks that, while rigorous, follow predictable procedural norms familiar to international compliance teams. For a crypto-asset service provider targeting clients across several Member States, a single CASP authorisation from Luxembourg with a MiCA passport is operationally simpler than maintaining multiple national licences.
The Grand Duchy also offers a well-developed corporate infrastructure. Holding and operating entities benefit from the SOPARFI regime, RCS Luxembourg registration is straightforward, and the Tribunal d'arrondissement provides a reliable dispute resolution forum. These practical anchors matter when structuring the legal entity that will carry the CASP licence and function as the passport vehicle into other jurisdictions.
That said, Luxembourg's attractiveness does not reduce the burden of the authorisation process itself. The CSSF applies MiCA's requirements in full, and a credible application demands substance: governance arrangements, qualified management, own funds, safeguarding arrangements, and AML/CFT policies that satisfy both MiCA Title V and Luxembourg's transposition of the relevant AML directives. There is no shortcut available simply because Luxembourg is the chosen domicile.
The Passporting Mechanism Under MiCA
MiCA introduces a single-licence passporting regime modelled broadly on the approach already used for investment firms and payment institutions. Once the CSSF grants a CASP authorisation, the firm may provide any of the authorised crypto-asset services across the EU by following the notification procedure set out in the Regulation. The home competent authority – in this case the CSSF – notifies the host-state authority, and the firm may begin activity in that host state after the required period has elapsed, unless the host authority raises objections on specific grounds.
The passport covers the specific services listed in the authorisation. Firms that later wish to add services, or to expand passporting to additional Member States, must follow supplementary notification or application procedures. This means the scope of the original CSSF authorisation must be planned carefully: a too-narrow initial application creates friction later, while an over-broad application that cannot be substantiated delays or jeopardises approval.
ESMA's public register recorded 325 authorised CASPs as of 12 August 2026, up from approximately 210 by May 2026. The rate of authorisations is accelerating, which means the competitive landscape for passporting slots is also shifting. Firms that delay now face not only regulatory risk but a more crowded pool of authorised operators already active in target markets.
The Cliff Edge: What the End of Grandfathering Means in Practice
The MiCA transitional period ended on 1 July 2026. ESMA confirmed on 17 April 2026 that no extension would be granted. On 23 June 2026, ESMA published a statement setting out the precise constraints on unauthorised CASPs still winding down: they must stop all new client onboarding, stop marketing their services, and limit their activities to selling or transferring client assets, or closing open positions. Providing crypto-asset services to EU clients without authorisation is now unlawful under MiCA.
For firms with a Luxembourg nexus – whether incorporated here, operating a branch here, or marketing to Luxembourg-based clients – the CSSF is the competent authority responsible for enforcement. The practical implications include:
- Immediate cessation of onboarding: Any Luxembourg-incorporated CASP without authorisation may not accept new clients or enter new service contracts.
- Marketing restrictions: Promotional activity directed at EU clients, including through digital channels, must stop until authorisation is obtained.
- Wind-down obligations: Existing client relationships must be managed toward an orderly exit – asset transfers, position closures – rather than continuation.
- Enforcement exposure: The CSSF has supervisory and sanctioning powers under MiCA; non-compliance is not a transitional grey area but a live regulatory breach.
If your firm is currently in a wind-down position or has not yet filed a complete CASP application with the CSSF, we encourage you to seek specialist advice promptly. Our team can be reached at info@ferrazwhitmore.com or through our contacts page.
AML/CFT: The Layer That Slows Most Applications
Experience across MiCA applications filed in multiple EU jurisdictions consistently shows that AML/CFT deficiencies are among the most common reasons for delay or refusal. Luxembourg's transposition of EU AML obligations imposes requirements that sit alongside MiCA's own provisions, and the CSSF scrutinises both layers. A CASP application that is strong on governance and own funds but weak on AML/CFT policy will stall.
Key AML/CFT pressure points for CASPs in Luxembourg include: identification and verification of the beneficial owner structure of the applicant entity, including through RCS Luxembourg filings and, where relevant, upstream SOPARFI or foreign holding vehicles; transaction monitoring capable of identifying suspicious activity across crypto-asset transfers; Travel Rule compliance for transfers above the applicable threshold; and policies addressing the specific risks of anonymity-enhanced tokens and self-hosted wallets where the CSSF has indicated heightened scrutiny.
Firms that have not yet reviewed their AML/CFT framework against CSSF expectations should do so before submitting a CASP application. Our AML compliance practice in Luxembourg can assist with gap analysis and documentation. Further detail on our approach is set out on our AML compliance service page for Luxembourg.
Structuring the Luxembourg Entity for MiCA Purposes
The choice of legal form and corporate structure for the CASP applicant has downstream consequences for the authorisation process, passporting mechanics, and ongoing governance obligations. Points that frequently arise in structuring discussions include:
- Substance requirements: The CSSF expects genuine decision-making to occur in Luxembourg. A shell registered at RCS Luxembourg with all effective management conducted abroad is unlikely to satisfy the home-state test.
- Capital and own funds: MiCA sets class-specific minimum own funds requirements. The structure must ensure that the Luxembourg entity can maintain those levels throughout its life, including during periods of market stress.
- Group structures: Where the CASP sits within a larger group – whether under a SOPARFI parent or an international holding company – intra-group transactions, outsourcing arrangements and data flows each require analysis against MiCA's requirements and CSSF supervisory expectations.
- Shareholder and beneficial owner disclosure: MiCA requires disclosure of all persons holding qualifying stakes, and the CSSF will assess fitness and propriety. Complex ownership chains increase the information burden and may lengthen the review timeline.
Corporate structuring decisions made before an application is filed are much easier to optimise than those made after the CSSF has begun its review. Our Luxembourg practice advises on entity design and governance ahead of application.
Interpreting MiCA's Open Questions in the Luxembourg Context
MiCA leaves a number of interpretive questions unresolved at the EU level, and their resolution in Luxembourg depends on a combination of CSSF supervisory guidance, ESMA technical standards (many of which were still being finalised as of mid-2026), and Luxembourg's national implementing measures. Practitioners and firms should be alert to the following areas of uncertainty:
- Scope of "crypto-asset services": The boundary between MiCA-regulated services and activities falling under existing financial instruments regulation (MiFID II, AIFMD) is not always clear, particularly for tokenised securities and structured DeFi products. The CSSF has not yet published comprehensive guidance on all edge cases.
- DeFi and self-custody: Fully decentralised protocols are not addressed in MiCA's text in a manner that provides certainty. CASPs operating hybrid models – partly decentralised, partly custodial – face classification risk that the CSSF may resolve differently from other national competent authorities.
- Stablecoin issuance versus distribution: Where a CASP distributes an e-money token or asset-referenced token issued by a third party, the allocation of regulatory obligations between issuer and distributor requires careful analysis of the MiCA text and any CSSF guidance in force.
- Passporting of new service types: As MiCA's service catalogue is exhaustive, firms wishing to offer novel services may find that no existing category captures their model precisely. The CSSF, like all competent authorities, will need to interpret the framework; engaging proactively is advisable.
These open questions are not reasons to delay action – the authorisation obligation applies regardless – but they do counsel in favour of engaging early with the CSSF and with specialist counsel rather than assuming the framework is fully settled. Our detailed analysis of the transition milestones is available in our MiCA transition alert for Luxembourg.
Cross-Border Implications: Using a Luxembourg CASP Passport Effectively
A CASP authorised by the CSSF may passport services into any EU Member State, but "may" does not mean "automatically operational". The firm must still comply with host-state requirements that MiCA explicitly reserves to national law – consumer protection rules, local language requirements for white papers and disclosures, and applicable tax obligations. None of these are waived by the passport.
Firms should also note that the passport covers the services for which authorisation has been granted. A CASP authorised only for custody and administration of crypto-assets on behalf of clients cannot rely on its Luxembourg passport to offer exchange or transfer services in another Member State without returning to the CSSF for an expanded authorisation. Planning the authorisation scope with the firm's full European distribution strategy in mind is therefore essential, not optional.
Third-country market access is a separate matter entirely. A Luxembourg CASP passport provides no automatic right to serve clients in the United Kingdom, Switzerland, the United States or other non-EEA markets. Those activities remain subject to the applicable national frameworks in each jurisdiction. Firms with genuinely global ambitions should take care not to conflate MiCA passporting with broader international regulatory clearance.
Strategic Recommendations for Firms at Different Stages
The appropriate strategy depends significantly on where a firm currently stands relative to the authorisation process:
- Firms with a complete CSSF application pending: The priority is ensuring the application file is complete and responds to any CSSF requests for information promptly. Incomplete files are suspended and timelines reset. Firms should maintain rigorous records of all communications with the CSSF and take legal advice before responding to any substantive queries about governance or AML/CFT.
- Firms that have not yet applied: Beginning the process now is urgent. The authorisation obligation is already in force, and every additional week of operation without authorisation (beyond permissible wind-down activity) increases enforcement exposure. A realistic application timeline should account for the preparation of all required documentation, internal governance approvals, and CSSF review time.
- Firms in wind-down under the 23 June 2026 ESMA guidance: These firms must ensure their wind-down procedures are documented and demonstrably compliant with the limitations on permitted activities. Legal advice on managing client notifications, asset transfers and position closures in an orderly manner protects both the firm and its clients.
- Non-EU firms considering Luxembourg as a licensing hub: The passporting benefits are real, but the CSSF will require genuine Luxembourg substance and will not accept a brass-plate structure. Pre-application planning – including on governance, staffing, AML/CFT frameworks and capital – is the most efficient use of time before any formal filing.
Our CASP licensing team in Luxembourg works with firms at each of these stages. If you would like to discuss your specific situation, please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Outlook: Regulatory Developments to Monitor
The MiCA framework is not static. ESMA continues to publish technical standards, Q&A documents and supervisory convergence guidance, and the CSSF adapts its supervisory practice accordingly. Firms operating under a Luxembourg CASP authorisation – or planning to apply for one – should monitor several developments in particular:
- The finalisation of remaining ESMA regulatory technical standards on, among other topics, information to be provided in applications, disclosure requirements for crypto-asset white papers, and market abuse detection obligations.
- Any CSSF-specific guidance on the application of MiCA requirements to Luxembourg-incorporated entities, which may clarify or supplement EU-level instruments.
- Revisions to EU AML legislation and the establishment of the Anti-Money Laundering Authority (AMLA), which will have direct supervisory competence over certain higher-risk CASPs and will introduce a further layer of regulatory interaction for Luxembourg-authorised firms.
- Developments in the treatment of DeFi and NFTs at EU level, where the Commission has indicated review processes are ongoing.
Staying current with this evolving framework is part of the compliance burden for any authorised CASP. Ferraz & Whitmore monitors regulatory developments across Luxembourg and the broader EU on behalf of clients in this space. Further information on our CASP licensing practice is available at our MiCA licensing page for Luxembourg. For specific queries or to discuss your authorisation strategy, please reach out at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.