On 17 August 2023, the CSSF published its first set of questions and answers on virtual asset service providers ("VASP") (the "Q&A"). In its Q&A, the CSSF provides clarity on some key questions, such as who has to register as a VASP with the CSSF and when that registration should be done.
Registration
The CSSF clarifies that any natural or legal person, who is either established in Luxembourg or providing virtual asset related services (the "VA services") in Luxembourg on behalf of or for its customers must register as a VASP in the CSSF register prior to offering such services. To assist in determining whether a person is subject to registration as a VASP, the Q&A provide detailed guidance on the analysis which should be conducted by such person. The Q&A also provide clarity on the internal criteria taken into consideration by the CSSF when determining if an entity not established in Luxembourg should nevertheless register as a VASP in case it provides VA services in Luxembourg.
Moreover, CSSF makes clear that credit institutions in Luxembourg can offer VA services, if they register as a VASP, while entities which solely provide the hardware and/or the software to support the offering of such services are not subject to registration requirements. The entities concerned should keep in mind that no passporting regime is available for VASPs under the current national or European legal framework.
ML/TF considerations
VASPs currently fall within the scope of the Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the "AML/CTF Law") and are required to comply with all professional obligations set out therein. In that context, the Q&A provides details on the level of information expected by the CSSF for the money laundering and terrorist financing ("ML/TF") risk assessments and ML/TF policies and procedures, which must be submitted as part of the VASP registration file. In addition, CSSF makes clear that VASPs should put in place an efficient process of transaction-monitoring, which, in principle, should be supported by automated tools, enabling prompt information by the VASP on its own initiative, to the Luxembourg Financial Intelligence Unit of any suspicious activities or transactions. Finally, VASPs must also comply with the applicable legal framework on financial restrictive measures.
CSSF role
The CSSF’s role for the registered VASPs is currently limited to ML/CTF related registration, supervision and enforcement for AML/CTF purposes only. Once a VASP is registered with the CSSF, the CSSF has all the supervisory, investigatory and sanctioning powers provided under the relevant provision of the AML/CTD Law.
Going forward
Entities already registered as VASPs with the CSSF or intending to be establish or to offer VA services in Luxembourg should take into consideration and monitor any updates to these Q&A; the CSSF points out that these Q&A have been drawn up on the basis of the current legal AML/CTF framework applicable to VASPs and do not take into account the evolution of the framework related to VA at European level (i.e. the Regulation on Markets in Crypto-Assets (“MICA”)).
Share on
