The blockchain market and related applications in Luxembourg have been growing steadily over the past 12 months. Luxembourg has established itself as a reputable and attractive jurisdiction for blockchain and crypto-related activities, thanks to its supportive regulatory framework, strong financial sector, innovation ecosystem and strategic location in the heart of Europe. From a Luxembourg legal and regulatory perspective, the FTX bankruptcy has had little impact on Luxembourg’s crypto activity, as the market is dominated by trusted and established players, which have demonstrated their resilience. Local players active in the financial sector have been more focused on the underlying distributed ledger technology (DLT) to revisit financial sector applications.

Luxembourg companies and individuals are exploring various applications of DLT in the financial sector, such as the following.

• Digital bonds: the European Investment Bank has now issued multiple bonds registered, transferred and kept using DLT processes. Two of these bonds are governed by Luxembourg law and are registered in the proprietary DLT platforms of Goldman Sachs in Germany and HSBC in Luxembourg. These bonds are listed on the Securities Official List (SOL) of the Luxembourg stock exchange.
• Collateral management: the Luxembourg-based HQLAx DLT-operated platform enables clients to exchange ownership of baskets of securities across disparate collateral pools at precise moments in time. The terms of service of the HQLAx platform are governed by Luxembourg law. 
• Crypto funds: some funds, such as Adrdn, have launched blockchain-based investment vehicles, which allow investors to subscribe to tokenised fund units. The Lemniscap Blockchain Fund has established a Luxembourg crypto VC fund investing in early-stage start-ups in the DLT field.
• Insurance: some insurers are using blockchain to increase efficiency and lower operation costs. For example, IBISA is a Luxembourg start-up with the mission to solve the lack of insurance for small-scale agriculture, especially in developing countries. It intends to use blockchain to keep the back-office costs low – ie, premium collection, payout, claim management and contract renewal.
• Crypto exchanges: some fintech companies, such as Bitstamp, BitFlyer and BitPanda, have obtained licences and authorisations from the Luxembourg financial regulator, the Commission de surveillance du secteur financier (the CSSF), to operate as crypto exchanges, custodians or brokers, and offer services to retail or institutional clients interested in buying, selling or storing digital assets.
• Blockchain solutions: some other fintech companies, such as Scorechain, Tokeny and Stokr, have developed solutions or platforms for blockchain analytics, tokenisation or crowdfunding, and serve various stakeholders in the blockchain ecosystem, such as regulators, issuers, investors or start-ups.
• Tokenisation of real-world assets: different issuers have used DLT to tokenise assets such as real estate and luxury goods, which are represented in tokenised and fractionalised format on the blockchain.
• Issuance, settlement and payment DLT-based platforms: certain market players are collaborating on developing a trusted network using DLT to serve as a single source of shared truth among the participants of investment ecosystems in financial instruments.

Luxembourg is also home to several initiatives and organisations, such as the Luxembourg Blockchain Lab, Infrachain and LHoFT, which foster collaboration, education and research in the blockchain field.

Luxembourg has a relatively favourable environment for the use of decentralised finance (DeFi) protocols, which offer various financial services without intermediaries or centralised authorities.

As an EU member state, Luxembourg has to comply with the EU’s harmonised rules and standards. Some of these rules may apply to DeFi activities and market players, depending on their nature, scope, customers and legal status. For example, the EU’s Markets in Crypto Assets Regulation (MiCAR) proposal, which was recently adopted by the EU Parliament and Council, aims to create a uniform regulatory framework for crypto-assets and related service providers, including some DeFi aspects. The EU’s Fifth Anti-Money Laundering Directive (AMLD5) and Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR) also impose due diligence, reporting and data protection obligations on crypto-asset service providers.

As to the regulatory position, in January 2022, the CSSF published a White Paper on DLT and blockchain (the “White Paper”) highlighting certain risks associated with the use of DLT and ways to mitigate such risks. This paper provides guidance on the conduct of due diligence processes related to DLT and its use in the provision of services in the Luxembourg financial sector. Even though the White Paper is not a legally binding document, it could be considered an indication of what the CSSF may be looking for when reviewing any DLT-based projects.

The White Paper is available here: https://www.cssf.lu/wp-content/uploads/DLT_WP.pdf

Overall, Luxembourg’s legal environment is forward-looking and pragmatic. The CSSF’s Innovation Hub conducts a constructive and open dialogue with the industry, provides insights on its regulation and offers guidance and follow-up throughout the regulation progress. The CSSF also ensures that all relevant legal texts and filings are available in English. Faced with DLT financial innovations, the CSSF promotes a neutral and prudent regulatory approach.

Market participants are beginning to explore benefits associated with the adoption of DeFi protocols. For example, in December 2022, Spuerkeess, Luxembourg State Bank, and the University of Luxembourg’s Centre for Security, Reliability and Trust announced a new research partnership aimed at bringing decentralised finance concepts to the market. The partnership intends to generate use cases, proofs of concept and new ideas in four areas in particular:

• crypto-assets;
• the Metaverse;
• mutualisation (application of a common blockchain-powered platform to mutualise loans); and
• optimising internal processing using blockchain.

Non-fungible tokens (NFTs) are unique digital assets that can represent various forms of art, collectibles, gaming items, identity or ownership rights.

The environment for the use of NFTs in Luxembourg is still developing, but there are some signs of interest and activity in this emerging field. An example that is accessible to Luxembourg residents is OpenSea, a marketplace for NFTs where users can buy, sell and discover different types of digital assets on multiple blockchain networks.

The main legal exercise when it comes to understanding the regulatory implications of a particular NFT is to clearly define its characteristics and what activity will be performed in respect of that NFT.

Although Luxembourg law provides no standalone definition for NFTs, the Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing (the “AML Law”) includes a definition of a “virtual asset” that may be applied to NFTs as “a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes”. If an NFT is caught under the definition of a virtual asset, any person who provides specific services in relation to that NFT must comply with the AML Law, including registration as a virtual asset service provider (VASP) with the CSSF.

Depending on the features and purpose of an NFT, certain activities in respect of such NFT could fall within one or more of the existing regulatory frameworks:

• if the NFT qualifies as a financial instrument, a number of activities including the buying, selling, intermediation and certain ancillary services may trigger a licensing requirement as an investment firm; and
• if the NFT qualifies as electronic money, a licensing requirement for an issuer as an electronic money institution may be triggered.

The above list is not exhaustive.

Furthermore, MiCAR will be directly applicable in Luxembourg. NFTs are in principle not covered by MiCAR since NFTs are unique and not interchangeable. However, there is an exception to this rule: if NFTs are divided into fractions or issued in big series or collections with identical characteristics, they will not be considered as unique or non-interchangeable (Recital 6c of MiCAR).

DLT itself is not subject to a specific regulation in Luxembourg as the Luxembourg legislature follows the principle of technological neutrality when crafting legislation. Laws and regulations should apply equally and consistently to all technologies, platforms and providers that perform similar functions, services or activities, regardless of their technical features or design.

Luxembourg has amended existing regulatory regimes to apply to market participants using DLT, depending on the type and function of the crypto-assets being dealt with and the activity performed by the market participant.

The existing Luxembourg legal framework in respect of fungible and intermediated financial instruments recorded via DLT comprises, notably:

• the Luxembourg Act dated 1 August 2001 on the circulation of securities, as amended (the “2001 Law”);
• the Luxembourg Act dated 6 April 2013 on dematerialised securities, as amended (the “2013 Law”); and
• the Luxembourg Act dated 5 August 2005 on financial collateral arrangements, as amended (the “Collateral Act 2005”).

The current regime covers the full life cycle of DLT financial instruments and allows for the native issuance of dematerialised securities and their transfer, safekeeping and collateralisation using DLT. Certain details on each of these acts are listed below.

• The 2013 Law expressly recognises the use of a blockchain or other DLT to record the issuance of Luxembourg law-governed dematerialised securities (by serving as the primary register of such issuance).
• The 2001 Law allows the use of DLTs in the context of the circulation of securities. It provides legal certainty to issuers to natively issue DLT securities by keeping their securities’ registers on a distributed ledger (such as a blockchain).
• The Collateral Act 2005 explicitly makes financial collateral arrangements over DLT financial instruments possible. The concept of book-entry transferable financial instruments now includes financial instruments registered or existing in securities accounts held within or through the secured electronic registration mechanisms, including DLT. Luxembourg is currently one of the only jurisdictions that explicitly recognises financial collateral arrangements over DLT financial instruments, enabling the use of DLT in financial collateral arrangements in a legally certain manner.

Furthermore, Luxembourg implemented important concepts in Luxembourg law to accompany Regulation (EU) 2022/858 of the European Parliament and of the Council of 30 May 2022, establishing a pilot regime for market infrastructures based on DLT (the “DLT Pilot Regime Regulation”).

Since Luxembourg is an EU member state, MiCAR will be directly applicable in Luxembourg. MiCAR covers natural and legal persons and other undertakings that issue, offer or trade crypto-assets or that offer crypto-asset services in the EU. Pursuant to MiCAR, crypto-assets are classified into three groups (electronic money, asset-referenced tokens and all other crypto-assets), each with different regulatory regimes based on the level of risk they pose.

According to MiCAR, to provide crypto-asset services in the EU, a person must be authorised as a professional crypto-asset service provider (CASP), unless they are already an EU-regulated entity that is exempt from MiCAR rules. CASPs will have the right to passport their authorisation throughout the EU.

Luxembourg has implemented certain rules and standards applicable to the blockchain sector proposed by international bodies such as the FATF or the BIS. Some of the laws or standards that Luxembourg has implemented or is in the process of implementing include the following.

The transposition of AMLD5 into national law introduced new anti-money laundering and counter-terrorism financing (AML/CFT) rules for virtual asset service providers and custodian wallet providers. As a result, VASPs and custodian wallet providers must:

• register or obtain a licence from the relevant authorities;
• conduct customer due diligence and verify the identity of their customers;
• monitor and report suspicious or large transactions involving virtual assets; and
• comply with other AML/CFT obligations and standards.

Luxembourg transposed AMLD5 in February 2020, with some additional provisions that go beyond the EU minimum standards, such as requiring VASPs to:

• obtain a payment institution or electronic money institution licence from the CSSF; and
• comply with the same prudential and conduct of business rules as other payment service providers.

Luxembourg follows the FATF Recommendations and the FATF Travel Rule, which are international standards for AML/CFT. These rules require VASPs to exchange information on the originator and beneficiary of virtual asset transfers above a certain threshold, as well as to co-operate with authorities and other VASPs.

The CSSF is the public authority responsible for supervising and regulating the financial sector in Luxembourg, except for the insurance sector, which falls under the supervision of the Commissariat aux Assurances. The CSSF supervises, regulates, authorises, informs, and, where appropriate, carries out on-site inspections and issues sanctions. Moreover, it is in charge of ensuring transparency, simplicity and fairness in the markets of financial products and services and is responsible for the enforcement of laws relating to financial consumer protection and the fight against money laundering and terrorist financing.

The authors are not aware of any material change in the CSSF’s approach following the notable bankruptcies in the blockchain sector in 2022.

The authors are not aware of trade groups performing regulatory or quasi-regulatory roles in Luxembourg. However, the Luxembourg Bankers’ Association (ABBL) and the Luxembourg Capital Markets Association (LuxCMA) regularly provide legal and regulatory positions applicable to the fintech sector.

The authors are not aware of any past or ongoing judicial decisions in Luxembourg that would have specifically impacted on the interpretation or the application of the Luxembourg legal regime for the use of blockchain.

The CSSF has published Circular 23/832 regarding the application of the ESMA guidelines on standard forms, formats and templates to apply for permission to operate a DLT market infrastructure in accordance with the DLT Pilot Regime Regulation.

Please refer to the White Paper discussed in 1.3 Decentralised Finance Environment and which was published by the CSSF in January 2022.

The Luxembourg institute for standardisation, accreditation, safety and quality of products and services (ILNAS) has also published a full dedicated report on blockchain technology and the legislative framework (in June 2021 – available at https://portail-qualite.public.lu/dam-assets/publications/normalisation/2021/ilnas-national-technical-standardization-report-blockchain-and-dlt.pdf).

Finally, some market participants have created the “Luxembourg Blockchain Lab”, which aims to support actors that are involved in blockchain technology and promote such technology in Luxembourg. The Luxembourg Blockchain Lab (https://blockchainlab.lu) organises events to allow market participants to meet blockchain experts and better understand the applicable legal framework.

Those elements should help Luxembourg market participants to better understand what is permitted when using blockchain technology.

Currently, the only existing DLT regulatory sandbox in Luxembourg is that created by the DLT Pilot Regime Regulation. It enables a regime in which market infrastructures can obtain exemptions from applicable financial regulations to be able to use DLT for the EU trading and settlement of securities transactions, thereby promoting the development of DLT in the financial sector.

Luxembourg has not yet implemented any specific direct or indirect tax rules or guidance for blockchain-based transactions, except for:

• a Circular dated 26 July 2018 (LIR No 14/5-99/3-99bis/3) that clarifies the Luxembourg income tax treatment of income derived from investing and mining in cryptocurrencies; and
• a Circular dated 11 June 2018 (No 787) that clarifies the Luxembourg VAT treatment of cryptocurrencies.

Although cryptocurrencies are assimilated with traditional currencies from a VAT perspective, this is not the case from a direct tax perspective. From a direct tax standpoint, cryptocurrencies are treated as intangible assets.

While the above-mentioned Circulars provide some clarity on the direct tax and VAT treatment of cryptocurrencies, there is still a lot of uncertainty regarding the tax treatment of other instruments that rely on blockchain technology, such as NFTs. The Luxembourg government is frequently urged to update the current law to create a secure legal and tax framework for investors in blockchain-based transactions in Luxembourg. Please refer to the Luxembourg Policy Recommendations of April 2023 of the Luxembourg Blockchain Lab.       

The CSSF has created an Innovation Hub, consisting of a dedicated point of contact for any person wishing to present an innovative project or to exchange views on the major challenges faced in relation to financial innovation in Luxembourg.

Within this framework, in order to gain the best possible understanding of fintech developments and expectations of the industry and to address the forthcoming challenges, the CSSF is in permanent contact with market players.

In addition, a non-profit association called “LëtzBlock” was set up to promote the adoption of DLT and blockchain technologies across public and private sectors in Luxembourg.

The ABBL and LuxCMA regularly provide legal and regulatory positions applicable to the fintech sector.

The transfer mechanics and recognition of ownership depend on the form of the crypto-asset in question.

As a general rule, a sale is valid and final under the Luxembourg Civil Code if:

• the parties have the capacity and consent to contract;
• the object and the price of the sale are determined or determinable; and
• the transfer of ownership is effective or agreed upon.

Therefore, a transfer on a blockchain of a digital asset can meet these conditions if:

• the parties are identified and have the capacity to use the blockchain network;
• the terms and conditions of the sale are encoded and executed by smart contracts; and
• the blockchain network provides a reliable and immutable record of the transfer of ownership.

Where a crypto-asset is the digital representation of a transferable financial instrument on a DLT network, the transfer mechanics and recognition of ownership in relation to such crypto-asset will be subject to the 2001 Law. Such crypto-assets are transferred via book entry on a securities account kept on a DLT and the transfer is considered final once the DLT financial instruments are credited to the relevant securities account.

The appropriate characterisation of digital assets in Luxembourg is determined by the specific features and rights attached to each digital asset, as well as the manner in which they are offered to the public or admitted to trading on a regulated market.

The CSSF considers DLT financial instruments that qualify as transferable securities within the meaning of MiFID II to be subject to the same rules and regulations as “traditional” securities, regardless of the technology used for their issuance or transfer. Therefore, the issuance, offering or admission to trading of such DLT financial instruments may require a prospectus, a licence or an authorisation from the CSSF, depending on the circumstances.

Digital assets that do not qualify as financial instruments under MiFID II will fall under the MiCAR regime.

The legal treatment of digital assets that aim to maintain a stable value by pegging to another asset in Luxembourg depends on how such digital assets are categorised.

They may fall under the scope of MiFID II as derivatives, thus becoming subject to the same rules as “traditional” financial instruments, depending on their characteristics such as underlying assets and events, their settlement methods and how they are traded.

Alternatively, such digital assets may fall under the MiCAR regime, which applies to crypto-assets that are not classified as financial instruments under MiFID II.

MiCAR distinguishes between two types of crypto-assets:

• asset-referenced tokens, which reference a value or right or a combination thereof, including one or more fiat currencies, such as stablecoins; and
• electronic money tokens, which reference the value of a single fiat currency.

MiCAR imposes various requirements and obligations on the issuers and service providers of these tokens, such as:

• authorisation;
• governance;
• disclosure;
• reserve management; and
• risk mitigation.

Under the Luxembourg Act of 10 November 2009 on payment services, as amended (the “2009 Act”), a “payment transaction” is defined as an act initiated by the payer or on their behalf to place, transfer or withdraw funds.

“Funds” are defined as banknotes and coins, scriptural money or electronic money – ie, a monetary value represented by a claim on the issuers that is:

• electronically stored;
• issued on receipt of funds for the purpose of making payment transactions; and
• accepted by a natural or legal person other than the electronic money issuer.

In Luxembourg, a digital asset is a token that constitutes a digital representation of value, which can be digitally traded, or transferred using DLT and cryptography.

A digital asset may be qualified as a virtual asset (such as cryptocurrencies), which is defined by the AML Law as a digital representation of value, including a virtual currency, which can be traded, or transferred, and which can be used for payment or investment purposes, and excludes virtual assets that fulfil the conditions of electronic money or financial instruments. Thus, a digital asset may be qualified as e-money, a financial instrument or virtual asset, depending on the characteristics of the digital asset.

Payment with cryptocurrencies in Luxembourg is not explicitly prohibited, but cryptocurrencies are not legally recognised as money or legal tender either. This means that cryptocurrencies are treated as intangible assets or digital tokens that can be exchanged for goods and services, but they do not have the same status, protection or guarantees as fiat currencies or electronic money.

According to the CSSF, cryptocurrencies are qualified as virtual assets under the AML Act and are subject to the same AML/CFT rules as other financial instruments, and any entity that provides services related to cryptocurrencies (such as exchange, custody or transfer) must obtain a licence and comply with the relevant regulations.

No persons established in Luxembourg or providing services in Luxembourg may provide virtual asset services (as listed under Article 1(20c) of the AML Act) without being registered with the CSSF as provided for in Article 7-1(1) of the AML Act.

There are no specific regulations applicable to the creation, marketing or sale of NFTs.

Luxembourg has not yet implemented any specific direct or indirect tax rules or guidance for NFTs. From a direct tax perspective, any capital gains realised upon the sale of NFTs may potentially be subject to taxation, also taking into account that a sale transaction involving NFTs would be settled in cryptocurrencies. The VAT treatment of sale of NFTs in Luxembourg is not clear-cut and will depend on the specific features and circumstances of each transaction. Some indications can be derived from the guidelines published by other EU jurisdictions, such as Belgium and Spain (see the points below, respectively) which suggest that the sale of NFTs should generally be regarded as an “electronic supply of service” fully subject to VAT.

• Service Public Fédéral Finances, «Commentaire TVA. Exemption visées par l’article 44, Section 3, du Code de la TVA – Opérations portant sur les devises, les billets de banque et les monnaies qui sont des moyens de paiement légaux», 1 April 2022; https://eservices.minfin.fgov.be/myminfin-web/pages/public/fisconet/document/5793545a-50a5-4426-af6f-305175d7d0cf.

See also, Service Public Fédéral Finances «la blockchain», 14 April 2022; https://eservices.minfin.fgov.be/myminfin-web/pages/public/fisconet/document/ed12d628-a53c-4fad-9969-1eaf4a049b2e.

• Binding Ruling V0482-22, of 10 March 2022, issued by the Spanish General Directorate of Taxes (Dirección General de Tributos).

The types of market that currently exist in Luxembourg for digital assets include the following.

• Custodial exchanges: some examples of custodial exchanges operating and supervised in Luxembourg are Bitstamp, BitFlyer and Coinhouse.
• Non-custodial exchanges: some examples of non-custodial exchanges available for access in Luxembourg are Bisq and Uniswap.
• Platforms for trading digital asset securities: these are platforms that facilitate the issuance, trading and settlement of digital assets that qualify as securities under Luxembourg law, such as shares, bonds or fund units. Digital asset securities are subject to the same rules and supervision as traditional securities, and may require the involvement of authorised intermediaries, such as central account keepers, brokers, custodians or central securities depositories. Some examples of markets for digital asset securities operating in Luxembourg are HSBC’s Orion platform, HQLAx STOKR and Bitbond. HSBC Orion leverages blockchain technology as a “single source of truth”, whereby asset and settlement tokens sit natively and securely on the platform’s ledger.
• Platforms to trade non-security digital assets: Bitstamp, BitFlyer and Coinhouse operate in Luxembourg and such platforms are supervised/registered by the CSSF.

The Law of 25 March 2020 on the issuance of electronic money and the provision of payment services (the “E-Money Law”) transposed AMLD5 and introduced VASPs.

A VASP is defined as any natural or legal person that provides one or more of the following services on behalf of or for the benefit of a third party:

• exchange of virtual assets for fiat currency, or vice versa;
• exchange of one or more forms of virtual assets for one or more other forms of virtual assets;
• transfer of virtual assets;
• safekeeping or administration of virtual assets or instruments enabling control over virtual assets; or
• participation in and provision of financial services related to an issuer’s offer or sale of virtual assets.

VASPs are subject to the same licensing, prudential, conduct of business and AML/CFT requirements as other payment service providers under the E-Money Law and the AML Law.

Therefore, in Luxembourg persons who want to exchange fiat currency for cryptocurrencies, or vice versa, or cryptocurrencies for other cryptocurrencies, must use a VASP that is authorised and supervised by the CSSF, or a foreign VASP that is recognised by the CSSF as equivalent.

Alternatively, they may use a licensed electronic money institution or a credit institution that offers such services, as these entities are also allowed to provide VASP services under the E-Money Law.

The AML Act subjects the providers of services related to virtual assets, such as exchange platforms, custodian wallet providers, brokers, dealers and advisers, to the same obligations as other financial sector professionals regarding customer due diligence, record-keeping, reporting of suspicious transactions and co-operation with the authorities.

In particular, VASPs must comply with the same KYC and AML/CFT rules as other financial professionals, such as identifying and verifying their customers, conducting risk assessments, reporting suspicious transactions and keeping records.

The AML Law also requires VASPs to register with the CSSF and to comply with a series of organisational and internal governance rules for AML purposes.

In addition, VASPs are subject to CSSF supervision and may be subject to sanctions if they do not comply with the AML/CFT regime.

Finally, the CSSF has issued several circulars and guidelines to clarify the registration process, the scope of the law, the applicable standards and the expectations of the regulator.

Government sanction rules also apply to transactions in virtual assets in Luxembourg under the Act of 27 October 2010 on the implementation of restrictive measures, as amended (the “2010 Act”). The 2010 Act applies to all natural and legal persons, entities and bodies subject to Luxembourg’s jurisdiction, and covers all funds, assets and economic resources, including digital assets, that are owned, held or controlled by designated persons or entities, or that are related to prohibited activities. The 2010 Act imposes obligations on the relevant persons and entities to freeze, report and refrain from dealing with the targeted persons, and to co-operate with the authorities. The 2010 Act also provides for criminal and administrative penalties for violations of the sanction rules.

As previously discussed, it is first necessary to determine the qualification of a digital asset.

If a digital asset is the digital representation of a financial instrument on a DLT network, the services in relation to such digital asset will be subject to the relevant regulation, such as the Luxembourg Act of 5 April 1993 on the financial sector, as amended (the “1993 Act”) and MiFID II. Digital assets stored on a blockchain that qualify as securities would be covered by the 2001 Law, and thus would have to abide by the rules of the 2001 Law.

If a digital asset meets the condition of being a payment instrument, the digital asset will then be subject to the 2009 Act and the regulatory regime applicable to e-money.

If a digital asset is neither a financial instrument nor a payment instrument, it will be qualified as a virtual asset. The market for virtual assets is not regulated per se in Luxembourg. As previously pointed out, an entity that contemplates providing services related to virtual assets is required to register with the CSSF as a VASP and to comply with the Luxembourg AML/CFT requirements.

A regulated entity providing services in relation to virtual assets (eg, a credit institution facilitating investments in virtual assets) must continue to comply with the obligations laid down in the different laws applicable to the entity.

An entity providing services in relation to digital assets to consumers in Luxembourg would remain under the obligation to comply with general Luxembourg consumer law, which prohibits, among other things, fraudulent and manipulative practices.

The authors are not aware of any sanctions issued by the CSSF in relation to digital assets or entities in the context of digital assets.

Re-hypothecation (or on-transfer) of digital assets by a digital asset exchange to third parties may raise legal and regulatory issues under Luxembourg law, depending on:

• the nature and status of the digital assets;
• the contractual arrangements between the exchange and its customers; and
• the applicable rules on custody, insolvency and anti-money laundering.

Generally, digital asset exchanges that provide custody or administration services for financial instruments or electronic money must segregate the assets of their customers from their own assets and from those of other customers, and must not use them for their own account or for the account of any other person without the express consent of the customer.

The Collateral Act 2005 expressly recognises collateral arrangements over financial instruments registered or existing in securities accounts held through DLT.

Digital assets that do not qualify as financial instruments or payment instruments may fall under the general civil law rules on property, contract and fiduciary arrangements. In this case, the legal status and ownership of the digital assets may depend on the terms and conditions of the exchange and the customer, and on the nature and features of the underlying technology and network. The exchange may be able to re-hypothecate the digital assets to third parties if the customer has agreed to transfer the property or the beneficial interest in the digital assets to the exchange, or if the exchange acts as a fiduciary or trustee for the customer.

Luxembourg does not have specific regulations for businesses that provide online or offline storage solutions for private cryptographic keys that control the ability to give instructions with respect to digital assets, such as cryptocurrencies or tokens. However, such businesses may fall under the scope of existing laws and regulations depending on the nature and features of their services and the type and status of their clients.

For instance, if a storage provider (that is, a custodian) offers custodial services, such as holding, managing or transferring digital assets on behalf of its clients, it may need to obtain a licence as a professional of the financial sector (PSF) under the 1993 Act. The PSF licence entails compliance with prudential, organisational and AML/CFT requirements, as well as supervision by the CSSF.

Alternatively, if a storage provider acts as a payment service provider, such as enabling the execution of payment transactions or the issuance of payment instruments involving digital assets, it may need to obtain a licence as a payment institution or an electronic money institution under the 2009 Act. The payment institution or electronic money institution licence also entails compliance with prudential, organisational and AML/CFT requirements, as well as supervision by the CSSF.

In any case, storage providers should also comply with the general obligations under the Civil Code, the Consumer Code, the Data Protection Law and the E-Commerce Law, as well as with any contractual terms and conditions agreed with their clients.

According to MiCAR, when making a public offer of crypto-assets, other than asset-referenced tokens or e-money tokens, in the EU or when seeking admission of crypto-assets to trading on a trading platform for such crypto-assets, offerors or persons seeking admission to trading should produce, notify to their competent authority and publish an information document (“a crypto-asset White Paper”) containing mandatory disclosures.

Depending on whether tokens are classified as transferable securities within the meaning of MiFID II, their public offer may fall under the regime of Regulation (EU) 2017/1129 of the European Parliament and of the Council of 14 June 2017 on the prospectus to be published when securities are offered to the public or admitted to trading on a regulated market.

In Luxembourg, the distinction between securities and commercial activity for token fundraising depends on the economic and legal rights and obligations attached to the tokens, as well as on the expectations and representations of issuers and investors. The CSSF applies a “substance over form” approach and a case-by-case analysis, taking into account the specific features and circumstances of each token and transaction. The CSSF has also advised token issuers and service providers to seek legal advice and to contact the regulator before launching any token-related activity in Luxembourg.

Fundraising through the sale of tokens intended to be used as part of a decentralised network by using a digital asset exchange as an intermediary may be subject to various regulations in Luxembourg, depending on the nature and characteristics of the tokens, the exchange and the fundraising process.

Potential regulations include the following.

• The 1993 Act, which regulates the provision of financial services and the supervision of financial professionals in Luxembourg.
• The 2001 Law, which defines the legal framework for the issuance, transfer and custody of securities in Luxembourg.
• The Law of 22 March 2004 on securitisation, which regulates the creation and operation of securitisation vehicles and transactions in Luxembourg. Depending on the structure and objectives of the fundraising, it may involve the securitisation of assets or risks through the issuance of tokens, and thus be subject to the rules and requirements of this law, such as the authorisation and supervision of the securitisation vehicle, the disclosure and reporting obligations, and the tax regime.

Luxembourg has not yet adopted a specific regulatory framework with respect to the treatment of crypto-assets distributed by airdrop. It is therefore necessary to turn to civil law concepts and more particularly to the rules applicable to donations, since airdropping an asset could be construed as a donation under Luxembourg law.

An act of donation is defined under the Luxembourg legal framework as a gratuitous and irrevocable transfer of property or rights from one person to another, motivated by generosity or moral duty, and accepted by the beneficiary.

The beneficiary should, however, be able to refuse a donation. Pursuant to Article 932 of the Luxembourg Civil Code, a donation shall not bind the donor and shall produce no effect until the day it has been expressly accepted through an authentic act of which a record must be kept. The donation will be perfected by the sole consent of the parties, and the property of the objects given will be transferred to the donee without the need of any other delivery. Therefore, it is implied that one can refuse the donation by not giving express consent.

No special regulations in Luxembourg are applicable to investment funds or collective investment schemes that invest in digital assets.

That said, undertakings for collective investments addressing non-professional customers and pension funds are not allowed to invest directly or indirectly in virtual assets.

In 2021, the CSSF published an FAQ on undertakings for collective investments investing in virtual assets, available here: https://www.cssf.lu/wp-content/uploads/FAQ_Virtual_Assets_UCI.pdf

In Luxembourg, the activity of broker-dealers or other financial intermediaries corresponds to the services of reception and transfer of orders (RTO) and execution of orders in relation to financial instruments.

If the digital asset is qualified as a financial instrument, the person providing RTO or execution services in relation to such a digital asset will be required to have the appropriate licence in Luxembourg (as a credit institution or investment firm) under the 1993 Act.

If the digital asset is qualified as a virtual asset under the AML Act, the entity providing certain services in relation to an issuer’s offer or sale of a virtual asset must be registered as a VASP, though it will not be regulated per se. However, the VASP is subject to the Luxembourg AML/CFT regime.

Therefore, broker-dealers or other financial intermediaries that deal in digital assets in Luxembourg need to assess the legal status and characteristics of the digital assets they offer, trade or hold, and comply with the applicable regulatory framework, which may vary depending on the type and function of the digital assets. They also need to obtain the necessary authorisations, licences or registrations from the competent authorities, such as the CSSF, and follow the relevant rules and standards on conduct of business, disclosure, reporting, risk management, governance and AML/CFT.

The general view is that the enforceability of a contractual arrangement requires the parties to have reached an agreement on the essential terms of the contract and with an intention to create legal relations. Luxembourg law follows the principle of technological neutrality. Therefore, the agreed-upon computer code may serve as evidence of such an agreement (in commercial matters the burden of proof is governed by the principle of the free assessment of evidence). Furthermore, the 2001 Law, the 2013 Law and the Collateral Act 2005 expressly recognise using DLT for the purposes of issuance, transfers and collateralisation of DLT financial instruments.

The authors are aware that, in certain common law countries, it is debated whether or not blockchain developers have fiduciary duties towards their users (ie, whether a contractual relationship should be considered between developers and users – reference is made to the decision in Tulip Trading Limited v Bitcoin Association for BSV [2022] EWHC 667 (Ch)). Since such a debate has not yet reached the Luxembourg courts, it cannot be confirmed whether, under Luxembourg law, blockchain developers should be considered as always having a contractual relationship with (and, moreover, fiduciary duties towards) users of the blockchain.

However, this does not mean that blockchain developers will never be held liable where losses are suffered from use of the blockchain. Indeed, under Luxembourg law, a person can be held liable on a contractual or tortious basis when there is:

• a fault (tortious or breach of the agreement);
• a loss; and
• a causal link between the fault and the loss.

It cannot be affirmed that, if a loss arises through the use of the blockchain, the blockchain developer will be de facto held liable. Indeed, in such a situation, a case-by-case analysis will be required in order to determine which actor is at fault.

DeFi platforms that match borrowers and lenders of digital assets are not explicitly prohibited in Luxembourg, but they may be subject to various regulations depending on the nature and scope of their activities, the type and features of the digital assets involved, and the identity and location of their users and counterparties.

One of the main regulatory challenges for DeFi platforms is determining whether the digital assets they facilitate are considered as financial instruments, electronic money, virtual currencies or other types of tokens under Luxembourg law. This may have implications for the licensing, prudential, conduct, AML and consumer protection requirements that apply to the platform and its participants.

For instance, if digital assets are deemed to be financial instruments, such as securities, derivatives or units of collective investment schemes, the platform may need to obtain an authorisation as an investment firm under the 1993 Act to operate a multilateral trading facility.

If digital assets are considered as electronic money, the platform may need to be authorised as an electronic money institution, and follow the rules on issuance, redemption, safeguarding and supervision of electronic money.

If digital assets are classified as virtual assets under the AML Act, the platform will fall under the scope of the AML Act and, thus, the platform will have to register with the CSSF as a VASP, and comply with the AML/CTF obligations.

If digital assets have other economic or legal functions, such as utility, access or governance tokens, the platform may still be subject to some general regulations, such as the Civil Code, the Commercial Code, the Consumer Code or the Data Protection Law. The platform may also have to consider the cross-border aspects of its activities and the potential application of foreign laws and regulations.

Different rules apply to different kinds of assets when someone wants to use them as security in Luxembourg. There are two main categories:

• those covered by the Collateral Act 2005; and
• others.

The Collateral Act 2005 applies to certain specific types of financial collateral, such as financial instruments and claims.

According to the Collateral Act 2005, financial instruments that are recorded or held in securities accounts through DLT are considered as book-entry transferable financial instruments. This means that the Collateral Act 2005 would apply to the security arrangements over such digital assets if:

• they are categorised as financial instruments recorded or held in securities accounts through DLT; and
• the obligations that are secured by them are financial and can be settled or delivered in cash, other financial instruments or their underlying assets.

Digital assets that are not within the scope of the Collateral Act 2005 are subject to the rules of the Civil Code and the Commercial Code. These rules require that the pledgor must hand over the assets to the pledgee (ie, transfer of possession) or to a third party who acts as a security agent or holder for them to create the security interest.

The formalities for ensuring the enforceability and validity of pledges may vary depending on their type:

• civil pledges – a civil pledge requires a written document (either notarised or under private seal) that describes the pledged assets in detail, such as their nature and characteristics; or
• commercial pledges – a commercial pledge does not need a written document and can be evidenced by any method allowed by the Commercial Code.

The Luxembourg Act of 1 March 2019, which amended the 2001 Act, introduced the possibility for investors to transfer digital assets to a custodian, provided that the custodian meets certain conditions.

According to the 2001 Act, a custodian of digital assets may be any person authorised pursuant to Luxembourg law to maintain securities accounts and active in the financial sector, which may refer to:

• a credit institution;
• an investment firm;
• a professional of the financial sector (PFS) authorised in Luxembourg;
• a central securities depository (CSD); or
• a settlement agent.

The custodian of digital assets must also comply with the following requirements to:

• ensure the integrity and security of the DLT system used for the registration and transfer of digital assets;
• keep a record of the digital assets held in custody and the identity of their owners;
• segregate the digital assets held in custody from its own assets and from those of other clients;
• inform the owners of the digital assets of their rights and obligations, as well as the risks and costs associated with the custody service; and
• apply the rules of AML/CTF.

The CSSF has the power to supervise and sanction the custodians of digital assets.

“Data privacy” is not a term commonly used in Luxembourg and is often used interchangeably with the term “data protection”. The main legal framework for data privacy and data protection in Luxembourg is the GDPR, which is an EU Regulation that sets out the principles, rights and obligations for the processing of personal data (ie, information relating to an identified or identifiable natural person).

There is no specific case law or enforcement action in Luxembourg regarding the compliance of blockchain-based products or services with the GDPR. However, the CNPD, the national data protection authority in Luxembourg, has referred to a study for the European Parliament that identified the potential conflicts between blockchain and the GDPR on its website. The CNIL, the French data protection authority, also issued a guidance paper in September 2018 on how to use blockchain responsibly in relation to personal data. The CNPD is likely to consider these publications when applying the GDPR to blockchain-based products or services.

The EDPB, the EU body for data protection that consists of representatives of the national data protection authorities, plans to publish guidelines on blockchain in its work programme for 2023–2024.

Processing personal data with blockchain-based products or services may present some challenges under the GDPR, due to the specific features of blockchain technology. These include its distributed, decentralised and immutable nature, which complicates the identification, allocation and enforcement of the roles and responsibilities of the various participants, such as users, developers and miners. Data controllers and processors need to be clearly defined, and data subjects need to have an accessible point of contact to exercise their rights effectively.

Moreover, blockchain is designed to prevent any modification or deletion of data, which conflicts with the rights of rectification and erasure granted by Articles 16 and 17 of the GDPR. The CNIL therefore suggests using cryptographic solutions instead. Additionally, the rules for transferring data outside the European Economic Area are hard to comply with, as blockchain controllers generally have no control over the location of miners.

Given these challenges, companies should carefully assess whether blockchain is the most suitable technology for their data processing purposes, in accordance with data protection by design and by default principles.

See 8.1 Data Privacy.

The mining of cryptocurrencies is not explicitly prohibited or regulated in Luxembourg, but it may be subject to certain legal and tax implications depending on the nature and purpose of the activity.

The authors expect that DLT projects using a “proof of work” consensus mechanism may attract particular attention from the CSSF, as according to Recital 5a of the MiCAR, the consensus mechanisms might have principal adverse impacts on the climate and have other environment-related effects. Such consensus mechanisms should therefore deploy more environmentally friendly solutions and ensure that any principal adverse impacts they might have on the climate and any other environment-related area are adequately identified and disclosed by issuers and crypto-asset service providers.

The “staking” of tokens to secure a blockchain-based network using a “proof of stake” consensus protocol is not regulated in Luxembourg.

Income derived from engaging in a “proof of stake” consensus protocol may constitute a commercial enterprise and be subject to taxation as a commercial profit, depending on the circumstances. The qualification of an activity as a commercial enterprise is not always straightforward and requires a specific assessment in each situation.

There is no sufficient market intelligence data regarding this topic.

There is no sufficient market intelligence data regarding this topic.

In the authors’ experience, there is often no need for the DAO to have a legal form if it may effectively be viewed as an internet-based platform allowing its participants to vote on certain projects and obtain certain priority access rights for these projects.

However, to facilitate interaction with non-DLT entities, a DAO can be created in the form of a commercial company. The authors note that, in such case, articles of association of a commercial company will need to be tailored to provide that to the extent possible under Luxembourg corporate law the results of the DAO’s smart contracts are determinative of the rights and obligations of the shareholders.

However, there may be certain limitations on achieving this goal. Luxembourg companies are managed by one or more managers – who may or may not be shareholders – appointed by the shareholders, either in the articles of association or by subsequent deed, for a limited or unlimited term. Luxembourg corporate law provides managers with control over a commercial company, and subjects them to fiduciary duties requiring them to act in the best interest of the shareholders.

Therefore, it would not be possible to strip authority entirely away from the managers and give it to the DAO members, though it would be possible to adopt shareholder resolutions for many express topics such as, for example, reserved matters provisions.

Alternatively, the DAO can take the form of a special limited partnership (SCSp) which does not have a legal personality. Such partnerships are not subject to the legal regime and formalities applicable to Luxembourg commercial companies. SCSps enjoy contractual freedom and the parties are free to contract on whatever terms suit them best.

An SCSp is commonly used as a fund, either regulated or unregulated depending on investors’ preferences.

The authors note that a DLT can be used in Luxembourg to maintain a register of shareholders of the company or unitholders of the SCSp, as applicable. In fact, DAO tokens can be shares of a commercial company or units in the SCSp, registered in a blockchain.