Luxembourg: Virtual Asset Service Providers In Luxembourg: State Of Play

Since the introduction of virtual asset service providers (VASPs) into the Luxembourg legal framework in 2020, only a limited number of VASPs have been registered. This publication aims at summarising the framework applicable to VASPs, provide an overview of the current status of VASP registrations in the country, and highlight the future developments that will impact relevant market players in Luxembourg and beyond.

VASPs in Luxembourg: Recap

VASPs were introduced into the Luxembourg legal framework on 25 March 2020 via the adoption of two distinct laws:

• The 'First 2020 Law' amending, amongst others, the law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the AML Law).
• The 'Second 2020 Law' (together with the First 2020 Law, the '2020 Laws') establishing a central electronic data retrieval system related to IBAN accounts and safe-deposit boxes.

The First 2020 Law introduced the concepts of 'virtual currency', 'virtual asset' (VA), 'virtual asset service provider', 'safekeeping or administration service provider', and 'custodian wallet service' into the AML Law, whereas the Second 2020 Law introduced a new registration requirement for VASPs.

The adoption of the 2020 Laws followed the adoption of Directive (EU) 2018/843¹ (AMLD 5). AMLD 5 amended Directive (EU) 2015/849² (AMLD 4) and introduced certain provisions related to virtual asset services, including:

• A definition of 'virtual currencies'.
• Two new 'obliged entities' (i.e. entities subject to AML/ CFT regulation), being the 'providers engaged in exchange services between virtual currencies and fiat currencies'³ , and custodian wallet providers.⁴
• A requirement for these new obliged entities to be registered in their Member States.

Whereas certain EU Member States transposed the Directive 'as is', i.e. only subjected providers engaged in exchange services between virtual currencies and fiat currencies and custodian wallet providers to AML/CFT obligations, Luxembourg went beyond the requirements of the Directive and used the transposition to introduce provisions matching the Financial Action Task Force (FATF) requirements stemming from the amendment to FATF's Recommendation 15 in October 2018⁵ and the FATF's updated guidance for a risk-based approach relating to VAs and VASPs, published on 28 October 2021.⁶

Luxembourg did not reflect the concepts used in AMLD 5, but instead introduced the concept of 'virtual asset service provider' which is defined (in alignment with the FATF) as "any person which provides, on behalf of or for its customer, one or more of the following services:

• The exchange between virtual assets and fiat currencies, including the service of exchange between virtual currencies and fiat currencies.
• The exchange between one or more forms of virtual assets.
• The transfer of virtual assets.
• The safekeeping or administration of virtual assets or instruments enabling control over virtual assets, including the custodian wallet service.
• The participation in and provision of financial services related to an issuer's offer or sale of a virtual asset."

One of the consequences of this approach is that the Luxembourg legal framework captures more market players than the Directive, and for instance, covers VA-to-VA exchanges, whereas the framework of other EU Member States does not.

Requirements applicable to VASPs

VASPs are not currently subject to a licencing or authorisation obligation in the traditional sense, unless they are also subject to a different regulatory framework due to their activities (such as banks for example). They are instead subject to a registration requirement set out in AML/CFT legislation⁷. Registration should be obtained prior to providing VA services in Luxembourg.

VASPs must register with the Luxembourg Commission de Surveillance du Secteur Financier (CSSF). To do so, they must submit a registration request to the CSSF. Prior to the submission, the CSSF typically expects a preliminary meeting during which the prospective VASP presents its planned activities, in order to allow both the CSSF and the VASP to raise preliminary questions or concerns.

The submission consists of an application accompanied by relevant supporting documentation, including corporate documents, information on the management of the VASP and other key persons, information about the planned activities, and information about the VASP's AML/CFT framework, IT systems, and any outsourcing arrangements. The submission is made electronically.

As the current registration obligation is mainly AML/CFT-driven, the applicants' AML/CFT framework constitutes the core element assessed by the authorities. VASPs are 'professionals' within the meaning of AML/CFT legislation⁸ ('obliged entities' according to the terminology of EU AML/ CFT directives), and must therefore comply with AML/CFT-related professional obligations. They must:

• perform a ML/TF risk assessment
• perform customer due diligence (CDD)
• monitor transactions
• keep appropriate records
• cooperate with the competent authorities, notably the CSSF and the Financial Intelligence Unit (Cellule de renseignement financier)
• ensure appropriate internal organisation, governance, and training for staff

VASPs must also comply with governance requirements. At least two persons must be in charge of the VASP's management, and those persons must have appropriate professional standing and experience. The submission of specific documents (including criminal records) is required. It is unclear how the CSSF would assess these requirements in relation to foreign entities, assuming foreign legislation does not require similar governance requirements.

The initial registration procedure is free, but VASPs providing services in Luxembourg and registered with the CSSF must pay an annual fee of EUR 15,000 (regardless of the type of VA service they provide)⁹. Since the registration is mandatory, VASPs intending to provide services in Luxembourg must take this fee into account in their budget.

Entities regulated under other legal frameworks (eg banks, payment institutions, etc) may also offer virtual asset services, but should then register as VASPs in addition to their existing licence.

To view the full article, click here.

Footnotes

1. Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU.

2. Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, as amended.

3. This concept was not further defined in AMLD 5

4. Defined as entities which provide services to safeguard private cryptographic keys on behalf of customers, to hold, store and transfer virtual currencies.

5. FATF (2012-2023), International Standards on Combating Money Launder- ing and the Financing of Terrorism & Proliferation, FATF, Paris, France, p. 17.

6. FATF (2021), Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers, FATF, Paris, p. 22-24, para. 47-54.

7. Art. 7-1 AML Law. 8 Art. 2(1)(16) AML Law.

9. Grand-ducal Regulation of 23 December 2022 relating to the fees to be levied by the Commission de Surveillance du Secteur Financier, Article 1, paragraph XXVI.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.