The CSSF and the FIU are responsible for implementing the country's AML framework. As part of the EEA, Luxembourg must comply with the EU’s AML directives.
In 2018, the CSSF released a guidance on AML compliance for CASPs. The guidance instructed CASPs to register with the CSSF and implement appropriate AML procedures. Following the 2018 guidance, the country decided to strengthen its AML framework further by implementing the EU’s Fifth Money Laundering Directive (5MLD).
When the Transfer of Funds Regulation (TFR) is applied on 30 December 2024, Luxembourg will be obliged to adhere to its rulings along with the Markets in Crypto Assets Regulation (MiCA). To ease this transition for local CASPs, the jurisdiction has applied an 18-month grandfathering period from the date of implementation.
In other words, entities providing crypto-asset services per national applicable laws (before 30 December 2024) can continue until 1 July 2026.
Please note this text has been prepared in line with the upcoming Transfer of Funds Regulation and its requirements for EEA members.
What is the scope of the Travel Rule in Luxembourg?
In line with the TFR, the Travel Rule will apply to the “transfers of funds, in any currency, or crypto assets, which are sent or received by a payment service provider, a crypto-asset service provider, or an intermediary service provider (brokers and custodians) established in the European Union”. (TFR CHAPTER I, Article 1)
Read about the EU Travel Rule in detail.
Who is the supervisory body for CASPs in Luxembourg?
The Commission de Surveillance du Secteur Financier (CSSF)
Financial Intelligence Unit (FIU).
What is the Travel Rule threshold in Luxembourg?
EUR 0
Is the Travel Rule applicable to self-hosted wallets in Luxembourg?
Like all jurisdictions under the EEA, Luxembourg will include self-hosted wallets in its implementation of the Travel Rule (when a CASP is involved in the transaction).
In other words, transfers to and from self-hosted wallets involving a CASP must be accompanied by the Travel Rule required information on the transfer’s originator and beneficiary.
Moreover, self-hosted wallet ownership must be proved when a wallet sends or receives transactions of more than EUR 1000 and in instances of suspected risk, fraud and the like.
When do you need to comply with the Travel Rule in Luxembourg?
CASPs need to have initiated their compliance regime already.
*CASPs not authorised by MiCA by 30 December 2024 - irrespective of the grandfathering period - will not be allowed to operate until the license is granted. As stated in MiCA Title V, Chapter 1, Article 59, “a person shall not provide crypto-asset services within the EU, unless that person is authorised as a CASP”.
What are FIU's requirements for Travel Rule information to be exchanged?
In line with the TFR, for all transfers, the originating CASP must communicate the following information with each crypto transfer before or simultaneously with the transfer:
originator's name;
originator's distributed ledger address;
originator's crypto asset account number;
originator's address, which must include the name of the country, official personal document number and customer identification number, or alternatively date and place of birth;
originator's LEI (where applicable, or an equivalent official identifier).
beneficiary's name;
beneficiary's distributed ledger address;
beneficiary's crypto asset account number;
beneficiary's LEI (where applicable, or an equivalent official identifier).
