A virtual asset is a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes. Virtual Asset Service Providers (VASPs) are companies registered as providing services related to virtual and crypto assets in Luxembourg. Entities wishing to provide such services in Luxembourg need to be registered as a VASP before starting their business, in accordance with the Anti-Money Laundering and Counter Terrorist Financing (AML/CTF) requirements laid out in EU Directives as implemented in the Grand-Duchy.
VASP is defined by the Luxembourg Law of 25 March 2020 (“AML5 Law”), transposing the provisions of Directive (EU) 2018/843 (“AMLD 5”) on the prevention of the use of the financial system for the purpose of money laundering or terrorist financing, entered into force on 30 March 2020. The goal of AML5 Law is to apply to entities qualifying as VASPs the same stringent AML/CTF requirements applied to traditional financial institutions.
The definition of VASP in the AML5 Law is intended to cover specific crypto services and functions and does not depend on the specific kind of entity, rather how the person uses the virtual assets and for whose benefit. Entities, who are established or provide services in Luxembourg, must therefore register with the Luxembourg financial sector supervisory authority, Commission de Surveillance du Secteur Financier (CSSF), in case they are providing one or more of the following services on behalf of or for their clients:
Firms must be registered as VASPs with the CSSF before they can provide virtual asset services in Luxembourg. Accordingly, the registration regime does not provide the applicant with an EU passport for the cross-border provision of virtual asset services in Europe, rather with a domestic registration for AML/CTF purposes. However, the registration requirement for VASP is without prejudice to any other license/registration required by law for any other passportable EU financial activities performed by the applicant.
The registration procedure is usually preceded by a meeting at the CSSF premises aiming to present the applicant and its project. Depending on the activities of the project, registration as a VASP may be necessary. The registration form is modelled on a payments institution (PI) application, and is handled by the same department at the CSSF. It is however substantially shorter, and focuses on:
Once the CSSF receives a registration file, it will proceed with a thorough analysis, which can include exchanging letters and, where appropriate, organising meeting(s) with the relevant stakeholders. The registration is effective upon inclusion of the applicant in the CSSF register which may take between 4 – 12 months, depending on the degree of complexity of each case.
The application for VASP registration with the CSSF is free. However, there is an annual lump sum of EUR 15,000 to be paid by each VASP, including each safekeeping or administration service provider, that provides services in Luxembourg and that is registered in Luxembourg. Furthermore, a lump sum of EUR 10,000 is foreseen for each on-site inspection conducted on a topic relating to AML/CTF.
The registration requirement as VASP for AML purposes under the AML5 Law is open for both natural and legal persons providing any of the services described above and therefore is not subject to any legal form requirements as such.
Summary of authorisation procedure