Since 1 July 2026, any business providing crypto-asset services to clients in the European Union must hold a MiCA authorisation as a Crypto-Asset Service Provider (CASP) – there are no transitional extensions. Luxembourg, with its established financial regulatory infrastructure and the Commission de Surveillance du Secteur Financier (CSSF) as competent authority, offers a credible and well-recognised jurisdiction in which to seek that authorisation. Ferraz & Whitmore advises international businesses on the full licensing process, from initial feasibility assessment through to passporting across EU member states.
Why the Deadline Has Changed the Landscape
ESMA confirmed that the MiCA transitional period ended on 1 July 2026 with no possibility of extension. Businesses that were operating under national transitional regimes – whether in Luxembourg or elsewhere – are now required to hold a valid CASP authorisation or to have ceased providing in-scope services. The consequences of non-compliance are serious: the CSSF has supervisory and sanctioning powers that include mandatory cessation of activities, public warnings, and administrative fines.
For many firms, the closing of the transitional window is the immediate trigger for action. If your business is currently offering exchange services, custody, portfolio management, order execution, or transfer services in relation to crypto-assets, and you do not yet hold a CASP licence, the risk of regulatory action is live and ongoing. Early engagement with a qualified legal adviser is the most effective way to understand your exposure and map a path to compliance.
If you are uncertain whether your activities fall within MiCA's scope or whether your current authorisation covers you, we encourage you to reach out directly. Write to us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
Why Luxembourg for MiCA CASP Authorisation
Luxembourg is one of Europe's principal fund and capital markets jurisdictions, and its regulatory framework for financial services is mature and internationally respected. The CSSF has engaged substantively with MiCA implementation, and its supervisory practices are broadly familiar to international businesses already operating in the EU financial sector.
There are several structural reasons why Luxembourg suits firms pursuing a CASP licence:
- Passporting: A CASP authorisation issued by the CSSF carries passporting rights across all EU member states, allowing a Luxembourg-licensed entity to provide crypto-asset services throughout the single market under the home-country supervision principle.
- Corporate infrastructure: Luxembourg's corporate law facilitates the establishment of appropriate legal entities – including the widely used SOPARFI holding structure – and registration with the Registre de Commerce et des Sociétés (RCS Luxembourg) is a well-established process supported by the Tribunal d'arrondissement.
- Capital markets ecosystem: Firms with existing capital markets activity in Luxembourg will find natural synergies with a CASP authorisation, given overlapping governance, AML compliance, and reporting obligations. Our team's work in capital markets in Luxembourg frequently intersects with the needs of crypto-asset businesses.
- Regulatory familiarity: International investors and institutional counterparties are generally comfortable with Luxembourg-domiciled entities, which can simplify commercial relationships and investor onboarding.
The Authorisation Process: An Overview
The CASP authorisation process under MiCA involves a structured application to the CSSF covering governance arrangements, capital requirements, organisational safeguards, white paper obligations, and ongoing compliance frameworks. Because the procedural detail is substantial, we have prepared a dedicated step-by-step resource: our MiCA CASP Licence Guide for Luxembourg sets out each stage of the application, the documentary requirements, and practical observations on typical CSSF expectations.
In summary, the key stages are:
- Pre-application scoping: identifying which crypto-asset services require authorisation and confirming the correct legal entity structure.
- Preparation of the application file: governance documents, programme of operations, capital adequacy evidence, and AML/CFT policies.
- White paper preparation: where applicable, drafting and reviewing the MiCA-compliant white paper for each crypto-asset.
- Submission and CSSF review: the CSSF has defined timelines for assessing completeness and for rendering a substantive decision, though the practical duration depends on file quality and the volume of queries raised.
- Post-authorisation obligations: ongoing reporting, record-keeping, passporting notifications, and periodic supervisory engagement.
A well-prepared application file reduces the risk of delays caused by requests for further information. Our experience is that deficiencies in governance documentation and AML compliance policies are among the most common sources of prolonged review periods.
AML/CFT Compliance as a Licensing Prerequisite
MiCA does not displace the EU's anti-money laundering framework; it sits alongside it. CASPs in Luxembourg are subject to AML/CFT obligations under both MiCA and applicable AML directives, and the CSSF will scrutinise the robustness of a firm's compliance programme as part of the authorisation assessment. A credible AML framework – covering customer due diligence, transaction monitoring, suspicious transaction reporting, and staff training – is not a box-ticking exercise; it is a material component of the licence application.
Our AML compliance practice in Luxembourg works in close coordination with our MiCA licensing team, ensuring that the compliance architecture built for licensing purposes is also operationally sound and sustainable beyond authorisation.
Typical Pitfalls and How to Avoid Them
Businesses approaching MiCA authorisation for the first time frequently encounter a number of recurring difficulties. Awareness of these issues at the outset can meaningfully improve the quality and timing of an application:
- Underestimating governance requirements: MiCA imposes specific requirements on management body composition, fitness and propriety of key function holders, and internal control frameworks. Applications that treat governance as a formality rather than a substantive requirement tend to generate significant follow-up from regulators.
- White paper deficiencies: The MiCA white paper is a legally prescribed disclosure document with defined content requirements. Errors, omissions, or misleading statements carry legal liability. Firms that draft white papers without legal review face both regulatory and civil risk.
- Passporting timing: Passporting is not automatic upon authorisation; it requires a separate notification procedure. Firms that plan to commence services in other member states on day one of authorisation need to factor passporting timelines into their commercial planning.
- Inadequate capital planning: The capital requirements applicable to a CASP depend on the category and scale of services provided. Underestimating these at the application stage can require costly restructuring later.
- Delayed entity establishment: If the applicant entity does not yet exist or is not yet registered with the RCS Luxembourg, the time required for incorporation and registration needs to be built into the overall project timeline.
Self-Assessment: Is Your Business Ready to Apply?
Before initiating a formal application, it is worth considering the following questions. This checklist is not exhaustive, but it identifies areas where preparation gaps are most frequently found:
- Have you confirmed which specific crypto-asset services your business provides, and mapped them to the CASP service categories under MiCA?
- Does your proposed entity have a clear governance structure, with identified management body members who meet fit and proper requirements?
- Have you assessed your capital requirements and confirmed that the entity can meet them at the time of authorisation?
- Is your AML/CFT framework documented, operational, and aligned with current regulatory expectations?
- If you issue or offer crypto-assets, have you identified which white paper obligations apply and allocated responsibility for their preparation?
- Have you mapped the EU jurisdictions in which you intend to provide services, and factored in the passporting notification process?
- Is the entity correctly incorporated and registered with the RCS Luxembourg, or is incorporation part of the project plan?
If you have identified gaps in any of these areas, addressing them before filing will improve both the quality of your application and your relationship with the CSSF as a supervisor going forward.
How Ferraz & Whitmore Approaches MiCA Mandates
Our approach to MiCA CASP licensing mandates in Luxembourg is built around the specific circumstances of each client. We begin with a scoping exercise to understand the business model, the crypto-asset services involved, the existing corporate and compliance infrastructure, and the commercial timeline. From that starting point, we develop a structured workplan that coordinates the legal, regulatory, and compliance workstreams.
We work with international businesses – including groups incorporating a Luxembourg entity specifically for MiCA purposes – as well as firms already established in Luxembourg that are seeking to add CASP authorisation to an existing regulatory permission. In both cases, the objective is the same: a robust, well-documented application that gives the client the best available basis for a positive outcome and a sustainable licensed business thereafter.
Our team includes lawyers qualified in Luxembourg and across multiple EU jurisdictions, enabling us to advise on cross-border structuring questions and to coordinate passporting strategies that reflect the commercial realities of operating across the single market.
To discuss your MiCA authorisation project with our Luxembourg team, please contact us at info@ferrazwhitmore.com or use our contacts page. We are available to assist at any stage of the process, from early-stage scoping to post-authorisation compliance support.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.