CHD ¦ Bill 8387 on the Implementation of MiCA and the Transfer of Funds Regulation

Luxembourg brings crypto-asset service providers under MiCA and the travel rule

Bill 8387 turns two EU crypto regulations into working Luxembourg law. It makes the CSSF the competent authority for the Markets in Crypto-Assets Regulation (EU) 2023/1114 (MiCA) and for the recast Transfer of Funds Regulation (EU) 2023/1113, gives it the supervisory, investigative and sanctioning powers both regulations require, and rewrites the AML/CFT law of 12 November 2004 so that crypto-asset service providers (CASPs) replace the former national category of virtual asset service providers (VASPs). The bill also implements the amended ELTIF Regulation and the European Green Bond Regulation, but for financial crime compliance the crypto chapters carry the weight. The Chamber of Deputies adopted it on 22 January 2025 with 58 votes in favour, two abstentions and none against, and the Council of State waived the second constitutional vote on 4 February 2025.

An omnibus bill with a crypto core

The Minister of Finance filed the bill on 21 May 2024. It implements four EU regulations at once, almost entirely by adding new chapters to the law of 16 July 2019 on the operationalisation of EU regulations in the field of financial services: chapter 4sexies for MiCA, chapter 4septies for the Transfer of Funds Regulation and chapter 4octies for European green bonds. Further amendments touch the financial sector law of 5 April 1993, the CSSF law of 23 December 1998, the payment services law of 10 November 2009 and the insurance sector law of 7 December 2015.

The Council of State criticised the bundling of unrelated subjects, arguing that it makes the legislation harder to read. It also issued two formal objections, one on the scope of the CSSF’s inspection powers and one on retroactive sanctions. The Finance Committee answered them with eight parliamentary amendments adopted on 15 November 2024, and the Council of State lifted both objections in its complementary opinion of 20 December 2024.

Bastian Schwind-Wagner _Follow

"Bill 8387 is mostly technical, yet for AML teams it settles how crypto fits into Luxembourg's AML/CFT law. The travel rule, the €1,000 threshold for occasional crypto transfers and the explicit duty to assess self-hosted addresses give supervisors concrete points to test.

I also welcome the clear end of the national VASP regime, with a fixed transition date and no parallel status. Any firm with crypto counterparties should be able to say, for each of them, whether it holds a MiCA authorisation."

MiCA powers for the CSSF

Article 20-28 gives the CSSF the full catalogue of powers in Article 94 MiCA, from requests for information and the suspension of offers to public warnings and orders to stop a practice. A second set of powers is aimed at market abuse in crypto-assets. The CSSF may enter premises and seize documents where there is a reasonable suspicion that they could prove insider dealing or market manipulation, require existing traffic data held by telecom operators, ask the president of the Luxembourg district court to freeze or sequester assets, and pass information to the State Prosecutor.

The original draft limited on-site inspections and position-reduction requests to entities under the CSSF’s prudential supervision. The Council of State objected that MiCA covers any person and that the restriction undermined the regulation’s direct applicability. The final text extends both powers to all persons. Inspecting someone outside the CSSF’s prudential supervision, however, needs prior authorisation from an investigating judge – the same safeguard that applies under the market abuse law of 23 December 2016.

Sanctions and the double jeopardy question

The administrative sanctions follow the structure of Article 111 MiCA. For breaches of the rules on offers, token issuers and CASPs, the CSSF can impose warnings, reprimands, public statements, cease-and-desist orders and fines of up to €700,000 for natural persons. Legal persons face up to €5 million or a share of annual turnover – 3%, 5% or 12.5% depending on the type of breach. CASP executives can be banned from management functions for up to five years.

Market abuse carries higher ceilings: up to €5 million for individuals and up to €15 million or 15% of annual turnover for legal persons, together with disgorgement and fines of up to three times the profit gained or loss avoided. Repeated breaches can lead to a ten-year management ban. Article 20-32 adds a criminal offence for intentional insider dealing, unlawful disclosure of inside information and market manipulation in crypto-assets. Individuals face three months to four years in prison and a fine of up to €5 million, legal persons a fine of up to €15 million.

Because the same conduct can be punished both administratively and criminally, Article 20-33 sets out a cooperation mechanism modelled on the market abuse law. The CSSF informs the State Prosecutor when it sees grounds for a sanction procedure, and the prosecutor has two weeks to decide whether to bring proceedings. If the prosecutor proceeds, the CSSF stands down. The Council of State accepted the mechanism but warned that it cannot fully rule out a breach of ne bis in idem, for instance where a victim launches a prosecution after the prosecutor has stepped aside. The Chamber of Commerce questioned the proportionality of the fine levels and raised the same principle.

The travel rule moves into the operationalisation law

Regulation (EU) 2023/1113 extends the information requirements for transfers of funds to transfers of crypto-assets, so that originator and beneficiary data travel with each transfer. This is the travel rule. Its predecessor, Regulation (EU) 2015/847, had been implemented in the payment services law. Since the new regulation also covers crypto-assets, the bill moves its implementation to chapter 4septies and repeals the old provisions in the payment services law.

The CSSF’s powers here mirror those it holds under Article 8-2 of the AML/CFT law. It can access documents, carry out on-site inspections and seizures, request telephone, electronic communication and traffic records, issue injunctions backed by periodic penalties of up to €1,250 a day and €25,000 in total, have assets frozen through the court and impose temporary professional bans. Ordinary breaches carry fines of €125 to €12,500. Repeated or systematic failures to send originator and beneficiary information, serious record-keeping failures, missing risk-based procedures and serious failures by intermediary providers open the full range of sanctions, up to withdrawal of authorisation and fines of up to €1 million or twice the benefit. For credit institutions the cap rises to €5 million or 10% of turnover. After a remark by the Council of State, breaches of data protection rules were taken out of the CSSF’s remit and left to the CNPD.

Crypto-asset service providers in the AML/CFT law

Chapter 4 of the bill transposes Article 38 of Regulation (EU) 2023/1113, which amended the fourth AML Directive. CASPs become financial institutions and obliged entities under the 2004 law. The FATF-based definitions of virtual currency, virtual asset and VASP give way to the EU terms crypto-asset, crypto-asset service provider, self-hosted address, transfer of crypto-assets, originator and beneficiary. Crypto-asset advice is left out of the AML definition of a CASP. According to the bill’s commentary, the scope of the law does not change in substance, because the MiCA list of crypto-asset services already covers the providers the FATF treats as VASPs.

Some obligations go further than the directive. CASPs must apply customer due diligence to occasional transactions that are transfers of crypto-assets above €1,000, a requirement taken from the interpretive note to FATF Recommendation 15. New Article 3-2(3bis) sets enhanced measures for cross-border correspondent relationships with non-EU entities providing similar crypto services. Before entering such a relationship, a CASP must check whether the respondent is licensed or registered, understand its business, reputation and quality of supervision, assess its AML/CFT controls, obtain senior management approval and document each party’s responsibilities. For payable-through accounts, it must make sure the respondent has carried out due diligence on customers with direct access. A decision to end a correspondent relationship for AML/CFT reasons must be documented.

Self-hosted addresses as a distinct risk

New Article 7-1bis requires CASPs to identify and assess the money laundering and terrorist financing risk of transfers to or from self-hosted addresses, backed by policies, procedures and internal controls. Mitigating measures have to be proportionate to the risk. They can include risk-based identification and verification of the originator, beneficiary or beneficial owner behind the self-hosted address, also through third parties, and requests for more information on where the crypto-assets come from and where they go. Enhanced ongoing monitoring of those transfers is another option, as is any other measure that manages laundering and terrorist financing risk or the risk that targeted financial sanctions, including those related to proliferation financing, are evaded.

The end of the VASP register

Article 7-1 of the 2004 law, which governed the registration of VASPs with the CSSF, is repealed. From 30 December 2024, no new VASP registration is possible, and any new provider needs a MiCA authorisation before it starts. Under the new Article 24-1, VASPs registered on 30 December 2024 remain on the register until 1 July 2026 or until their MiCA authorisation is granted or refused, whichever comes first. This follows the grandfathering clause in Article 143(3) MiCA.

During that period, registered VASPs stay within the scope of the AML/CFT law with all its professional obligations. They are treated as CASPs for the correspondent rules, the self-hosted address rules and the Transfer of Funds Regulation, and the CSSF remains their supervisor. At the request of the Council of State, the former registration conditions in Article 7-1(3) to (6) – fit and proper requirements, deregistration, the right of appeal and the ban on advertising the registration – continue to apply until 1 July 2026. The commentary encourages registered VASPs to move to the MiCA regime well before that date.

Entry into force without retroactive penalties

The draft tied its dates to the application of the EU regulations, with the MiCA chapter producing its effects from 30 June 2024. The Council of State formally objected because this would have made criminal and administrative sanctions retroactive, contrary to Article 19 of the Constitution and Article 49 of the EU Charter of Fundamental Rights. Under the final text, the law enters into force on the day of its publication in the Official Journal. The MiCA chapter still takes effect from 30 June 2024 and the green bond chapter from 21 December 2024, but in both cases the sanction articles apply only from publication.

What firms should take from it

For compliance teams, the practical changes are the travel rule, the €1,000 due diligence threshold for occasional crypto transfers, the correspondent requirements and the risk-based treatment of self-hosted addresses. Banks, payment institutions and investment funds with crypto exposure should check whether their counterparties hold a MiCA authorisation or are registered VASPs still inside the transition window, which runs until 1 July 2026 at the latest. Firms that could face a market abuse investigation in crypto-assets should expect the CSSF and the State Prosecutor to decide first which of them takes the case.

Dive deeper

• CHD ¦ Projet de loi 8387 – Dossier consolidé (mise en oeuvre des règlements (UE) 2023/606, 2023/1114, 2023/1113 et 2023/2631, modification de la loi du 12 novembre 2004 et d’autres lois financières) ¦ Link