MiCA Crypto Licence in Luxembourg
Luxembourg is a very high-reputation MiCA route for serious CASP operations that need EU/EEA passporting and can support CSSF-level governance, local substance, banking preparation and ongoing compliance.
Regulatory status should be confirmed by local counsel before relying on this route.
What is MiCA CASP authorisation in Luxembourg?
Luxembourg MiCA CASP authorisation is an EU crypto-asset service provider route supervised by the CSSF. It is designed for regulated CASP operations that can evidence governance, AML controls, safeguarding, audit readiness and a credible local operating model.
- Jurisdiction
- Luxembourg
- Regulator
- Commission de Surveillance du Secteur Financier (CSSF)
- Regime
- MICA
- Legal basis
- Regulator: Commission de Surveillance du Secteur Financier (CSSF).
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Luxembourg MiCA passporting and CASP service scope
Luxembourg can support EU/EEA passporting, but passporting is not a standalone product. The cross-border plan must follow the CASP services approved in Luxembourg and the operating model described in the application file.
Exchange
IncludedExchange operations fit within the permitted activities of this route.
Exchange
Exchange operations fit within the permitted activities of this route.
IncludedCustody
IncludedCustody is within scope; review controls requirements.
Custody
Custody is within scope; review controls requirements.
IncludedBrokerage
IncludedBrokerage or OTC activity typically fits within scope.
Brokerage
Brokerage or OTC activity typically fits within scope.
IncludedWallet provider
IncludedExchange operations fit within the permitted activities of this route.
Wallet provider
Exchange operations fit within the permitted activities of this route.
IncludedEU market
IncludedEU/EEA passporting available.
EU market
EU/EEA passporting available.
IncludedStartups
ExcludedHigh setup complexity means significant budget is needed.
Startups
High setup complexity means significant budget is needed.
Excluded
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Luxembourg as a MiCA home member state
Luxembourg is strongest when reputation, institutional credibility and EU market access matter more than the lowest setup budget. It is a demanding home member state choice, not a shortcut for early-stage startups.
Regulatory track record
PositiveVery high
Regulatory track record
Very high
PositiveBanking access for crypto firms
CautionMedium
Banking access for crypto firms
Medium
CautionRegulatory risk
CautionLow to medium
Regulatory risk
Low to medium
Caution
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Luxembourg MiCA application bottlenecks
The main bottlenecks are usually not only forms and policies. Luxembourg is a very high-complexity route, so weak governance, vague service scope, underfunded substance and late banking preparation can slow the project.
- High
Unclear CASP service perimeter or passporting plan
- High
Insufficient local staff, office, audit budget or compliance ownership
- High
Weak safeguarding, custody, ICT or outsourcing controls
- High
AML documentation that does not match the real transaction flows
- High
Banking or PSP package prepared too late for medium-difficulty onboarding
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Activity fit for this route
Review which crypto activities fit within the scope of this route.
Exchange operations fit within the permitted activities of this route.
Custody is within scope; review controls requirements.
Brokerage or OTC activity typically fits within scope.
Exchange operations fit within the permitted activities of this route.
EU/EEA passporting available.
High setup complexity means significant budget is needed.
Not sure if your model fits? Request a licensing assessment
Is Luxembourg MiCA authorisation right for your project?
Best for
- EU passporting and regulated CASP operations
- EU/EEA market access
Not suitable for
- Low-budget startups
Core requirements
Use this section to check the main regulatory and operational requirements before committing to a jurisdiction.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Local substance in Luxembourg
Luxembourg substance should be planned as a real operating commitment. Staff, physical office and audit are all required in the CSV snapshot, and the governance story must be credible for a very high-complexity jurisdiction.
Local staff
RequiredRequired
At least one locally-accountable staff member or director is expected.
Physical office
RequiredRequired
A genuine office presence is expected, not a nominal registered address.
Audit
RequiredRequired
External audit is required for ongoing supervision compliance.
Planning notes
- Plan local management, compliance ownership and regulator-facing accountability from the start.
- Budget office, staff, audit and ongoing reporting separately from the 32 200 EUR service price.
- Avoid a nominal setup that cannot explain Luxembourg decision-making, controls and escalation paths.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Cost breakdown
Budget for service price, regulatory fees, share capital and ongoing costs separately.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Cost breakdown — Luxembourg
Budget for service price, regulatory fees, share capital and ongoing costs separately.
| Cost item | Amount |
|---|---|
| Service priceApplication preparation and professional services. | €32,200 |
| State fee | €15,000 |
| Required share capitalMust be held, not an expenditure. | €50,000 |
Summary
- One-off costs
- €97,200
- Annual (year 1)
- €0
- Total year 1
- €97,200
Adjust to convert to your base currency.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Application process
The sequence below shows the usual project flow. Exact steps depend on the regulator, business model and application scope. Luxembourg — From 6 months.
Pre-assessment and scope review
1–3 weeksDefine the activity scope, governance model and target markets before formal preparation.
Company setup in Luxembourg
2–6 weeksEstablish legal entity, appoint local staff and set up local operating structure.
Documentation and compliance packBottleneck risk
3–8 weeksPrepare AML/CFT policies, governance documents, controls framework and application materials.
Application submission to Commission de Surveillance du Secteur Financier
1–2 weeksSubmit complete application with all required documentation.
Regulator reviewBottleneck risk
From 6 monthsRegulator reviews the application. May request clarifications. Incomplete files extend this phase.
Depends on: File quality and completeness
Authorisation or registration confirmation
1–4 weeksRegulator confirms authorisation or registration. Commence operations.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
What can delay or increase cost
These factors are most likely to affect timelines and budgets for this route.
Setup complexity is rated high for Luxembourg. Company setup, governance and documentation take longer than average.
Ongoing supervision, audit and compliance costs are above average. Budget for these separately from the application fee.
Incomplete files are the most common cause of delay. Regulator queries extend review by weeks or months.
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Banking and PSP strategy
Luxembourg has a strong financial-sector reputation, but the CSV snapshot lists both banking and PSP availability as medium. Banking preparation should therefore run in parallel with the MiCA application, not after approval.
Reflects how challenging it is to open and maintain business bank accounts in this jurisdiction.
Reflects availability of payment service providers willing to onboard crypto-licensed entities.
A licence or registration does not guarantee bank account or payment provider approval. Banking feasibility should be reviewed before the application strategy is finalized.
Preparation checklist
- Prepare flow-of-funds diagrams, safeguarding approach, source-of-funds evidence and token admission policy.
- Custody, exchange and fiat-heavy models should be packaged for bank and PSP due diligence early.
- A CSSF-facing MiCA file can support credibility, but it does not guarantee account opening or PSP acceptance.
When Luxembourg MiCA may not be the right fit
Luxembourg should be compared against other MiCA and non-EU routes when the business does not need a very high-reputation EU authorisation. The route is expensive to maintain and should be chosen for a clear commercial reason.
The company is a low-budget startup or still validating the product.
The main target market is outside the EU/EEA and passporting has limited commercial value.
The team cannot support local staff, office, audit, governance and ongoing CSSF-level compliance.
The model is mostly DeFi, payment services, securities-like products or staking without a separate scope review.
Consider instead
- Germany MICA — Strong banking access and mature financial supervision
- Malta MICA — Established CASP-facing regulator with lower service cost
- Lithuania MICA — Lower cost EU passporting option
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Business model fit — Luxembourg
Assess how well this route covers your planned activities.
Fit score
- Good fit
- 4/6
- Partial fit
- 2/6
- Poor fit
- 0/6
Luxembourg is a strong fit for your activity profile
This route covers your key activities. Proceed with detailed legal review.
CSSF regulator profile
Commission de Surveillance du Secteur Financier (CSSF)
The CSSF profile should be treated as high-expectation financial supervision. A Luxembourg application needs precise service scope, accountable governance, AML ownership, ICT controls, safeguarding logic and clear outsourcing oversight.
- Very high reputation can help with institutional counterparties, but it raises the quality bar for the file.
- The application needs to identify who controls the Luxembourg operation, not only where documents are stored.
- CSSF-facing policies should match the actual CASP model, token universe, client flows and risk appetite.
Strong international recognition and established supervision track record.
Reflects documentation depth, governance requirements and expected review friction.
Reflects likelihood of delays, additional information requests or policy uncertainty.
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Compliance documentation
Most crypto licensing routes require a documented compliance framework before submission, not only after approval.
- RequiredAML/CFT policy and risk assessmentDocument your customer risk model and control framework.
- RequiredCustomer due diligence (CDD) procedures
- RequiredEnhanced due diligence (EDD) proceduresFor high-risk clients and jurisdictions.
- RequiredTransaction monitoring system and rules
- RequiredSanctions screening procedures
- RequiredSuspicious activity reporting (SAR) process
- RequiredMLRO / Compliance officer appointmentLocal accountability may be required.
- RecommendedBoard-approved governance charter
- ConditionalOutsourcing policy and monitoringRequired if functions are outsourced.
- RecommendedICT / cybersecurity policy
- RequiredComplaints handling procedure
- RequiredAnnual external audit engagementRequired for ongoing supervision compliance.
Country-specific regulatory statements should be checked against current regulator guidance before relying on this route.
Documents to prepare
Preparing these materials before filing reduces regulator questions and helps with banking or payment provider onboarding.
Corporate documents
AML and compliance
Operational
Fees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Risk assessment
Main risk dimensions for the Luxembourg route.
Route risk rating — setup complexity: Very high.
Route risk rating — maintenance cost: Very high. Budget for ongoing compliance, fees and supervision separately.
Route risk rating — regulatory reputation: Very high.
Route risk rating — regulatory risk: Low to medium. Weak compliance, vague scope or insufficient controls increase review risk.
Mitigation: Prepare an evidence-based compliance file before submission.
Route risk rating — banking difficulty: Medium. Authorisation does not guarantee bank account opening.
Mitigation: Start banking outreach and compliance preparation before the application.
This content is for general orientation only. Crypto regulation changes quickly and the final scope should be confirmed through a jurisdiction-specific legal review before filing or incorporation.
Luxembourg vs other MiCA countries
Compare Luxembourg with Germany for another high-reputation EU route, Malta for established CASP supervision at lower service cost, and Lithuania for a lower-cost passporting option. Non-EU VASP or registration routes can be relevant only when EU passporting is not required.
Luxembourg
MICA
- Price
- 32 200 EUR
- Timeline
- From 6 months
- Passporting
- EU/EEA
- Banking
- Medium
- Reputation
- Very high
Germany
MICA
- Price
- 28 500 EUR
- Timeline
- From 6 months
- Passporting
- EU/EEA
- Banking
- Low
- Reputation
- High
+ Strong banking access and mature financial supervision
− Still a high-complexity MiCA route
View routeMalta
MICA
- Price
- 20 700 EUR
- Timeline
- From 6 months
- Passporting
- EU/EEA
- Banking
- Medium to high
- Reputation
- High
+ Established CASP-facing regulator with lower service cost
− Lower institutional prestige than Luxembourg
View routeLithuania
MICA
- Price
- 16 600 EUR
- Timeline
- From 6 months
- Passporting
- EU/EEA
- Banking
- Medium
- Reputation
- Medium
+ Lower cost EU passporting option
− Less suitable when brand reputation is the main buying criterion
View routeFees, timelines and capital figures are indicative and may vary by business model, regulator feedback, application scope and third-party costs.
Luxembourg vs other MiCA jurisdictions
Compare key parameters across MiCA-authorised jurisdictions.
Check your readiness for Luxembourg MiCA authorisation
Documented AML/CFT policies, risk assessment, compliance officer.
From 50 000 EUR minimum capital required.
Documented AML/CFT policies, risk assessment, compliance officer.
Board, management, accountability chain defined.
Banking strategy and identified partners.
Local staff and office in Luxembourg.
Readiness status
Answer the criteria on the left to see your readiness status.
Frequently asked questions
No. Luxembourg is positioned as a very high-reputation and very high-complexity MiCA jurisdiction. It is better for serious CASP operations than low-budget startups.
Yes, Luxembourg is an EU/EEA passporting route for MiCA CASP services, but passporting must follow the approved service scope and the correct home member state process.
The difficult parts are usually precise service scope, local substance, governance, AML controls, safeguarding, ICT and outsourcing evidence, audit readiness and banking or PSP due diligence.
The supplied CSV facts show a 32 200 EUR service price, 15 000 EUR state fee, 15 000 EUR annual supervision fee and share capital from 50 000 EUR. Staff, office, audit and ongoing compliance should be budgeted separately.
Luxembourg is usually not the first choice for low-budget startups, offshore-only projects, teams without real EU substance or models that mainly need non-EU access instead of EU/EEA passporting.
The page is not legal advice and should not be relied on as a substitute for advice from qualified counsel in the relevant jurisdiction.
Your dedicated specialists
Enrico
Rein
Jurata
Andrej
Marta
Katrin
Inga
Request a Luxembourg MiCA assessment
Share your planned activities, target markets and timeline. We will review which crypto licensing route is likely to fit.