To obtain a MiCA Crypto-Asset Service Provider (CASP) licence in Luxembourg, a firm must submit a formal authorisation application to the Commission de Surveillance du Secteur Financier (CSSF), meet the organisational, capital and AML/CFT requirements set out in Regulation (EU) 2023/1114, and demonstrate substance in the Grand Duchy. As of 1 July 2026, the MiCA transitional (grandfathering) period has closed and providing crypto-asset services to EU clients without a valid CASP authorisation is unlawful; any firm still operating without authorisation is required to wind down in an orderly manner in line with the ESMA public statement of 23 June 2026. This guide sets out the step-by-step procedure, key documents, realistic timelines and the most common errors made by foreign applicants.
Why Luxembourg and Why Now
Luxembourg has long been a preferred domicile for cross-border financial services businesses, and the CSSF's established track record with fund managers, payment institutions and investment firms makes it a natural first-choice jurisdiction for MiCA authorisation. The Grand Duchy's transposition infrastructure, access to EU passporting, and the depth of its financial-services ecosystem give it structural advantages over smaller or less-experienced competent authorities.
The urgency is real. ESMA's statement of 17 April 2026 confirmed that no extension of the grandfathering period would be granted, and its subsequent public statement of 23 June 2026 made clear that unauthorised CASPs must immediately stop onboarding new clients and marketing their services, restricting activity to selling or transferring assets, closing open positions, and orderly wind-down. With 325 authorised CASPs recorded in the ESMA register as of 12 August 2026, competition for authorisation slots and CSSF attention is intense. Delay is no longer a viable strategy.
Understanding the Legal Framework
The primary legal basis is Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA), which is directly applicable across all EU Member States. Title V of MiCA governs CASP authorisation and sets out the obligations applicable to all nine categories of crypto-asset service, from custody and operation of a trading platform to exchange, transfer, portfolio management, advice, order reception and transmission, placing, and underwriting.
Luxembourg-specific procedural rules, fees and any national-level supplements are determined by the CSSF in accordance with its supervisory mandate. Applicants should treat the CSSF Q&A publications and supervisory guidance as living documents, as national implementation details continue to be refined. Where MiCA is silent on a specific point at national level, the CSSF generally looks to analogous rules applicable to investment firms and payment institutions already supervised under Luxembourg law.
Step-by-Step Procedure for CASP Authorisation in Luxembourg
Step 1: Assess Scope and Structuring
Before preparing any documentation, determine precisely which of the nine MiCA crypto-asset services your firm intends to provide, and whether any of your proposed activities might already be captured by existing financial-instruments or e-money regulation. A firm that also deals in instruments meeting the definition of transferable securities will need to consider the intersection with MiFID II. Structuring decisions made at this stage – including choice of legal form, share capital allocation, and governance arrangements – are difficult and costly to reverse later.
Most international applicants incorporate a SOPARFI (Société de Participations Financières) or a standard société anonyme (SA) or société à responsabilité limitée (Sàrl) as the Luxembourg operating entity. The legal form must be registered with the Registre de Commerce et des Sociétés (RCS Luxembourg) before the authorisation application can be filed. If the entity does not yet exist, allow time for incorporation, which involves notarial deed execution and, if applicable, a hearing before the Tribunal d'arrondissement for certain corporate acts.
Step 2: Establish Genuine Substance
The CSSF applies a substance test rigorously. A letterbox entity will not be authorised. At minimum, expect the CSSF to require:
- At least one senior manager (ideally the CEO or equivalent) physically present and resident in Luxembourg, with demonstrable decision-making authority;
- A registered office that constitutes genuine operational premises, not merely a legal address;
- A local compliance officer with sufficient experience in AML/CFT and financial-services regulation;
- IT and operational infrastructure, or credible contractual arrangements for outsourced services, that can be effectively overseen from Luxembourg.
Outsourcing arrangements are permitted under MiCA but must be documented, limited in scope, and subject to CSSF notification or approval depending on their materiality. Critical functions may not be outsourced in a manner that impairs the CSSF's ability to supervise the firm.
Step 3: Prepare the Authorisation File
The MiCA authorisation file is substantial. Applicants should prepare the following core documents, among others:
- Programme of operations: a detailed description of each intended crypto-asset service, target markets, and intended crypto-assets in scope;
- Business plan: three-year financial projections, revenue model, and capital adequacy analysis demonstrating compliance with MiCA's own-funds requirements for the relevant service category;
- Governance and organisational structure: an organisational chart, terms of reference for the management body and any committees, and a conflicts-of-interest policy;
- Fit-and-proper assessments: detailed CVs, criminal record extracts, and declarations for each member of the management body and persons holding a qualifying holding;
- Beneficial ownership disclosure: full beneficial owner chain up to ultimate natural persons, consistent with Luxembourg AML/CFT law and the RCS beneficial-owner register;
- AML/CFT policies and procedures: a comprehensive AML/CFT framework covering customer due diligence, transaction monitoring, suspicious transaction reporting, and the appointment of an AML compliance officer and reporting officer;
- Technology and security documentation: system architecture, cybersecurity policies, business continuity and disaster recovery plans;
- Client asset protection arrangements: where custody services are offered, a clear description of safeguarding mechanisms;
- Complaints-handling procedure and conflicts-of-interest framework;
- Insurance or equivalent guarantee: where required for the specific service category, evidence of professional indemnity cover or own-funds equivalence.
Documents originating outside Luxembourg will generally need to be translated into French, German or English (the CSSF accepts all three), and official documents issued by foreign authorities may need to be apostilled.
Step 4: Submit the Application to the CSSF
Applications are submitted through the CSSF's dedicated supervisory portal. The CSSF will conduct a completeness check upon receipt; an incomplete file will be returned with observations, restarting the clock. It is therefore critical to ensure the file is comprehensive before submission rather than relying on iterative supplementation.
The CSSF has up to 25 working days to declare the application complete, and thereafter a further 40 working days to take a decision, with the possibility of a one-time extension under MiCA Article 63. In practice, the clock may be paused if the CSSF raises questions requiring substantive responses, and complex files with novel business models or significant outsourcing arrangements tend to attract more intensive scrutiny. Applicants should anticipate an interactive process with the CSSF team throughout the review period.
Step 5: Respond to CSSF Queries and Attend Supervisory Meetings
The CSSF typically engages in dialogue with applicants during the review period. Management body interviews may be requested to assess the fit-and-proper standing of directors and senior managers. Responses to queries must be prompt, accurate and consistent with the original application file. Contradictions between the initial file and subsequent responses are a frequent source of delay and occasionally of refusal.
Step 6: Receive Authorisation and Register with ESMA
Upon a positive decision, the CSSF issues the CASP authorisation and notifies ESMA for inclusion in the EU-wide register of authorised CASPs. The authorisation specifies the services and, where relevant, the crypto-assets covered. Conditions or restrictions may be attached; these must be reviewed carefully and complied with before commencing regulated activity.
Once registered, the firm may exercise its EU passport to provide services cross-border under the MiCA notification procedure. For firms with clients or operations in multiple Member States, a considered passporting strategy is worth developing at the outset rather than as an afterthought.
AML/CFT: The Non-Negotiable Layer
Luxembourg has a strong and well-developed AML/CFT framework, and the CSSF expects CASP applicants to demonstrate mastery of it. The AML/CFT chapter of the authorisation file is routinely one of the most heavily scrutinised sections. Common weaknesses identified in applications include generic or template-based policies that are not tailored to crypto-asset-specific risks (such as chain analytics, peer-to-peer transactions and privacy coins), inadequate risk assessment methodology, and insufficient detail on the proposed transaction monitoring system.
The beneficial owner register obligations under Luxembourg law require that ultimate beneficial owners of the applicant entity are correctly identified, verified and registered. Discrepancies between the RCS filing and the information provided to the CSSF create immediate credibility problems and can delay or derail an application.
If your firm needs to review or strengthen its AML/CFT policies ahead of the CASP application, our team can assist. Contact us at info@ferrazwhitmore.com or visit our AML compliance service page for Luxembourg for further information.
Capital Requirements and Cost Drivers
MiCA sets tiered own-funds requirements depending on the services provided, with the highest thresholds applying to firms operating trading platforms. The exact minimum capital figure applicable to your firm depends on which service categories are authorised and must be calculated by reference to MiCA's own provisions, as the CSSF applies them without modification. In addition to regulatory capital, applicants should budget for:
- Incorporation and notarial costs for the Luxembourg entity;
- Physical office and staffing costs for the substance requirements;
- Legal and compliance advisory fees for file preparation;
- Technology investment or third-party contracts for chain analytics and transaction monitoring;
- Professional indemnity insurance where applicable;
- CSSF supervisory fees (the annual supervisory fee structure is published by the CSSF and should be factored into ongoing operating cost projections).
Firms that underestimate the cost of genuine substance – particularly the recruitment of qualified local compliance and senior management personnel – frequently encounter difficulties during the supervisory review.
Common Errors by Foreign Applicants
Based on the pattern of CASP and predecessor (VFA/registration) applications seen across EU jurisdictions, the following errors are disproportionately common among non-EU applicants approaching the Luxembourg process for the first time:
- Treating the application as a formality: the CSSF conducts substantive, not merely administrative, review. A thin file will not be approved on the basis of brand reputation or volume of business.
- Insufficient local substance: nominating a local director without genuine authority, or relying on a serviced-office address, is unlikely to satisfy CSSF expectations.
- Generic AML/CFT documentation: copy-paste policies drafted for a different jurisdiction or a different regulated activity are immediately apparent to experienced reviewers.
- Underestimating the beneficial ownership disclosure burden: complex holding structures involving multiple tiers of non-EU entities require early-stage mapping and documentary preparation.
- Misaligning the programme of operations with the business plan: inconsistencies between the services described in the programme of operations and the revenue model in the business plan generate CSSF queries that could have been avoided with careful internal review.
- Starting too late: with the grandfathering period closed as of 1 July 2026 and ESMA having confirmed no extensions, firms that have not yet begun the authorisation process are already exposed to enforcement risk.
Passporting After Authorisation
One of the principal advantages of a Luxembourg CASP licence is the ability to passport services into other EU/EEA Member States through the MiCA notification procedure, without the need for separate national authorisations. This makes Luxembourg an efficient hub for firms with a pan-European client base or ambitions. The notification procedure involves informing the CSSF, which in turn notifies the host Member State competent authority; the timeline and conditions are set by MiCA and do not require host-state approval in the same manner as a fresh authorisation.
For detailed guidance on structuring a cross-border CASP operation from Luxembourg, see our analysis of MiCA passporting strategy for Luxembourg-based CASPs.
Decision Checklist: Is Your Firm Ready to Apply?
Before filing, confirm that your firm can answer positively to each of the following:
- The Luxembourg legal entity is incorporated and registered with the RCS;
- Ultimate beneficial owners are identified, verified and registered in accordance with Luxembourg AML law;
- At least one senior manager with genuine authority is present in Luxembourg;
- The management body meets MiCA fit-and-proper requirements and CSSF expects to meet them;
- Own funds meet or exceed the applicable MiCA minimum for the intended service categories;
- AML/CFT policies are crypto-asset-specific, risk-based and complete;
- Technology documentation, business continuity plans and client-asset safeguarding arrangements are in final form;
- The programme of operations, business plan and financial projections are internally consistent;
- All foreign-authority documents have been translated and apostilled where required.
If you are preparing a CASP authorisation application in Luxembourg or assessing your options, our team is available to discuss your specific situation. Reach us at info@ferrazwhitmore.com or through our contacts page.
Working with Legal Counsel in Luxembourg
The CASP authorisation process is document-intensive, regulatory-technical and – given the current enforcement environment – time-sensitive. Engaging a law firm in Luxembourg with specific MiCA and financial-regulation experience at the scoping stage, rather than the drafting stage, reduces the risk of structural errors that are costly to correct mid-application. A lawyer in Luxembourg familiar with CSSF expectations can also assist in managing the supervisory dialogue during the review period, where tone and precision of response matter.
Ferraz & Whitmore advises clients on the full MiCA authorisation lifecycle in Luxembourg, from pre-application structuring through to post-authorisation compliance and passporting. For a full overview of our services in this area, visit our MiCA licensing service page for Luxembourg.
To begin a confidential discussion about your CASP authorisation, contact our team at info@ferrazwhitmore.com or visit our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.