The blockchain market and related applications in Luxembourg have been growing steadily over the past 12 months. Luxembourg has established itself as a reputable and attractive jurisdiction for blockchain and crypto-related activities thanks to its supportive regulatory framework, strong financial sector, innovation ecosystem and strategic location in the heart of Europe. From a Luxembourg legal and regulatory perspective, the FTX bankruptcy has had little impact on Luxembourg’s crypto activity, as the market is dominated by trusted and established players that have demonstrated their resilience. Local players active in the financial sector have been more focused on the underlying distributed ledger technology (DLT) for revisiting financial sector applications.

Luxembourg companies and individuals are exploring various applications of DLT in the financial sector, such as the following.

Digital Bonds

The European Investment Bank has now issued multiple bonds registered, transferred and kept using DLT processes. These bonds are governed by Luxembourg law and are registered in the proprietary DLT platforms of Goldman Sachs in Germany and HSBC in Luxembourg. These bonds are listed on the Securities Official List (SOL) of the Luxembourg stock exchange. In June 2023, the European Investment Bank issued the digital Climate Awareness Bond (CAB) using so|bond, the sustainable and open digital bond platform built on blockchain technology launched by Crédit Agricole CIB and SEB in April 2023. The platform uses the Proof of Climate awaReness (PoCR) protocol, which significantly lowers energy consumption and incentivises participating nodes to improve the environmental footprint of their infrastructures.

Collateral Management

The Luxembourg-based DLT-operated platform HQLAx enables clients to exchange ownership of baskets of securities across disparate collateral pools at precise moments in time. The terms of service of the HQLAx platform are governed by Luxembourg law.

Crypto Funds

Some funds, such as Adrdn, have launched blockchain-based investment vehicles, which allow investors to subscribe to tokenised fund units. The Lemniscap Blockchain Fund has established a Luxembourg venture capital (VC) crypto fund investing in early-stage start-ups in the DLT field. 6 Monks (6M) has been granted authorisation by the Luxembourg financial regulator, the Commission de Surveillance du Secteur Financier (CSSF), to provide alternative investment fund management (AIFM) services to third-party funds investing in Web3 and crypto-assets. It is the first independent AIFM authorised by the CSSF to provide these services, and is one of the first AIFMs authorised for crypto-assets in the European Union.

Insurance

Some insurers are using blockchain to increase efficiency and lower operation costs. For example, IBISA is a Luxembourg start-up with a mission to solve the lack of insurance for small-scale agriculture, especially in developing countries. It intends to use blockchain to keep back-office costs low – ie, premium collection, payout, claim management and contract renewal.

Crypto-Exchanges

Some fintech companies, such as Bitstamp, BitFlyer, and BitPanda, have obtained licences and authorisations from the CSSF to operate as crypto-exchanges, custodians or brokers and to offer services to retail or institutional clients interested in buying, selling or storing digital assets.

Blockchain Solutions

Some other fintech companies, such as Scorechain, Tokeny and Stokr, have developed solutions or platforms for blockchain analytics, tokenisation and crowdfunding. They serve various stakeholders in the blockchain ecosystem, such as regulators, issuers, investors or start-ups.

Liquidity Providers

London-based crypto liquidity provider B2C2 has registered as a virtual asset service provider in Luxembourg, making it the 12th registered virtual asset service provider in the country. Having registered with the CSSF, B2C2 aims to offer institutional clients over-the-counter spot cryptocurrency services.

Tokenisation of Real World Assets

Different issuers have used DLT to tokenise assets, such as real estate and luxury goods, which are represented in tokenised and fractionalised format on the blockchain.

Issuance, Settlement and Payment DLT-based Platforms

Certain market players are collaborating on developing a trusted network using DLT, to serve as a single source of shared truth among the participants of investment ecosystems in financial instruments.

Luxembourg is also home to several initiatives and organisations, such as the Luxembourg Blockchain Lab, Infrachain and LHoFT, which foster collaboration, education and research in the blockchain field.

The transfer mechanics and recognition of ownership depend on the form of the digital asset in question.

As a general rule, a sale is valid and final under the Luxembourg Civil Code if:

• the parties have the capacity and consent to contract;
• the object and the price of the sale are determined or determinable; and
• the transfer of ownership is effective or agreed upon.

Therefore, a transfer on a blockchain of a digital asset can meet these conditions if:

• the parties are identified and have the capacity to use the blockchain network;
• the terms and conditions of the sale are encoded and executed by smart contracts; and
• the blockchain network provides a reliable and immutable record of the transfer of ownership.

Where a digital asset is the digital representation of a transferable financial instrument on a DLT network, the transfer mechanics and recognition of ownership in relation to such digital asset will be subject to the Luxembourg Act dated 1 August 2001 on the circulation of securities, as amended. Such digital assets are transferred via book entry on a securities account kept on a DLT, and the transfer is considered final once the DLT financial instruments are credited to the relevant securities account.

The appropriate characterisation of digital assets in Luxembourg is determined by the specific features and rights attached to each digital asset, as well as by the manner in which they are offered to the public or admitted to trading on a regulated market.

In Luxembourg, digital assets that qualify as transferable securities within the meaning of MiFID II are subject to the same rules and regulations as “traditional” securities, regardless of the technology used for their issuance or transfer. Therefore, the issuance, offering or admission to trading of such digital financial instruments may require a prospectus, a licence or an authorisation from the CSSF, depending on the circumstances.

Digital assets that do not qualify as financial instruments under MiFID II would generally fall under the MiCAR regime.

It is worth mentioning that in a press release on 28 February 2024 the CSSF encouraged credit institutions, e-money institutions and any other undertaking wishing to issue electronic money tokens (EMTs) or asset-referenced tokens (ARTs) before the entry into force of MiCAR (ie, 30 June 2024) to familiarise themselves with the provisions of Titles III and IV of MiCAR relating to the authorisation and supervision of ARTs/EMTs by their national competent authority.

Securities under Luxembourg law can be issued in three different forms:

• bearer;
• dematerialised; or
• registered.

Depending on the form, different rules apply to the issuance, transfer and recording of securities.

Bearer securities are represented by physical certificates that can be transferred by delivery and endorsement. They are required to be immobilised with a depositary and the register of such immobilised securities can be held through DLT.

Dematerialised securities are registered by way of inscription in a securities issuance account maintained by a settlement organisation or a central account keeper. Both the securities issuance account and the securities accounts where digital securities are recorded may be held through DLT. Dematerialised securities are transferred via book entry on a securities account kept on a DLT, and the transfer is considered final once the digital securities are credited to the relevant securities account.

Registered securities are recorded in a register maintained by an issuer or a registrar. Transfers of registered securities are made by means of the recording of a transfer being entered in the relevant register. The securities register may also be held through DLT.

In respect of securities wrapped into digital tokens, they need to be contractually tied to the securities that are validly issued.

Since 2019, Luxembourg has developed a bespoke regime enabling the issuance, trading and settlement of securities natively issued on a DLT. Rather than creating a standalone regime, the Luxembourg legislature opted for a light-touch approach, adapting the existing legal framework to the specificities of DLT. Notably, three subsequent laws have made targeted amendments to the legislation on the circulation of securities, dematerialised securities and financial collateral arrangements, enabling DLT networks to issue, transfer and safekeep tokenised securities, as well as allowing the use of tokenised securities as collateral.

The legal treatment of digital assets that aim to maintain a stable value by pegging to another asset in Luxembourg depends on how such digital assets are categorised.

They may fall under the scope of MiFID II as derivatives, thus becoming subject to the same rules as “traditional” derivative instruments, depending on their characteristics, such as underlying assets and events, their settlement methods and how they are traded.

Alternatively, stablecoins may fall under the MiCAR regime, which applies to crypto-assets that are not classified as financial instruments under MiFID II.

MiCAR distinguishes between two types of crypto-assets that may have features of a stablecoin:

• asset-referenced tokens, which reference a value, a right or a combination thereof, including one or more fiat currencies, such as stablecoins; and
• electronic money tokens, which reference the value of a single fiat currency.

MiCAR imposes various requirements and obligations on the issuers and service providers of these tokens, such as:

• authorisation;
• governance;
• disclosure;
• reserve management; and
• risk mitigation.

The CSSF reminded investors on 7 August 2023 that, until 30 June 2024, ARTs or EMTs do not constitute regulated products in Luxembourg, though these activities will be subject to Titles III and IV of MiCAR from 30 June 2024.

Non-fungible tokens (NFTs) are unique digital assets that can represent various forms of art, collectibles, gaming items, identity or ownership rights.

The environment for the use of NFTs in Luxembourg is still developing, though there are some signs of interest and activity in this emerging field. For example, in 2023, Luxembourg POST started to offer the first Luxembourg crypto stamp in co-operation with PostNL and Österreichische Post.

The main legal exercise when it comes to understanding the regulatory implications of a particular NFT is to clearly define its characteristics and what activity will be performed in respect of that NFT.

Although Luxembourg law provides no standalone definition for NFTs, the Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing (the “AML Law”) includes a definition of a “virtual asset” that may be applied to NFTs as “a digital representation of value that can be digitally traded, or transferred, and can be used for payment or investment purposes”. If an NFT is caught under the definition of a virtual asset, any person who provides specific services in relation to that NFT must comply with the AML Law, including registration as a virtual asset service provider (VASP) with the CSSF.

Depending on the features and purpose of an NFT, certain activities in respect of such NFT could fall within one or more of the existing regulatory frameworks:

• if the NFT qualifies as a financial instrument, a number of activities – including buying, selling, intermediation and certain ancillary services – may trigger a licensing requirement as an investment firm; and
• if the NFT qualifies as electronic money, a licensing requirement for an issuer as an electronic money institution may be triggered.

The above list is not exhaustive.

Furthermore, MiCAR will be directly applicable in Luxembourg. NFTs are, in principle, not covered by MiCAR since NFTs are unique and non-interchangeable. However, there is an exception to this rule: if NFTs are divided into fractions or issued in big series or collections with identical characteristics, they will not be considered as unique or non-interchangeable (Recital 6c of MiCAR).

Under the Luxembourg Act of 10 November 2009 on payment services, as amended (the “2009 Act”), a “payment transaction” is defined as an act initiated by the payer or on their behalf to place, transfer or withdraw funds.

“Funds” are defined as banknotes and coins, scriptural money or electronic money – ie, a monetary value represented by a claim on the issuers that is:

• electronically stored;
• issued on receipt of funds for the purpose of making payment transactions; and
• accepted by a natural or legal person other than the electronic money issuer.

In Luxembourg, a digital asset is a token that constitutes a digital representation of value, which can be digitally traded or transferred using DLT and cryptography.

A digital asset may be qualified as a virtual asset (such as cryptocurrency). This is defined by the AML Law as a digital representation of value, including a virtual currency, which can be traded or transferred and which can be used for payment or investment purposes, and excludes virtual assets that fulfil the conditions of electronic money or financial instruments. Thus, a digital asset may be qualified as electronic money, a financial instrument or a virtual asset depending on the characteristics of the digital asset.

Payment with cryptocurrencies in Luxembourg is not explicitly prohibited, though cryptocurrencies are not legally recognised as money or legal tender. This means that cryptocurrencies are treated as intangible assets or as digital tokens that can be exchanged for goods and services, but they do not have the same status, protection or guarantees as fiat currencies or electronic money.

According to the CSSF, cryptocurrencies are qualified as virtual assets under the AML Act and are subject to the same anti-money laundering and counter-terrorism financing (AML/CFT) rules as other financial instruments. Any entity that provides services related to cryptocurrencies (such as exchange, custody or transfer) must obtain a licence and comply with the relevant regulations.

No persons established in Luxembourg or providing services in Luxembourg may provide virtual asset services (as listed under Article 1(20c) of the AML Act) without being registered with the CSSF (as provided for in Article 7-1(1) of the AML Act).

New requirements will apply from 30 June 2024 in respect of the issuance, offering or trading of asset-referenced tokens (ARTs) and electronic money tokens (EMTs) as per the requirements of MiCAR, and as further detailed in 4.1.1 Regulatory Overview. Furthermore, new transparency requirements will apply in respect of transfers of crypto-assets from 30 December 2024 in accordance with the requirements of the recast Transfer of Funds Regulation (Regulation (EU) 2023/1113).

The Collateral Act 2005 expressly recognises collateral arrangements over financial instruments registered or existing in securities accounts held through DLT.

Digital assets that do not qualify as financial instruments or payment instruments may fall under the general civil law rules on property, contract and fiduciary arrangements. In this case, the legal status and ownership of the digital assets may depend on the terms and conditions of the exchange and the customer, and on the nature and features of the underlying technology and network. The exchange may be able to re-hypothecate the digital assets to third parties if the customer has agreed to transfer the property or the beneficial interest in the digital assets to the exchange, or if the exchange acts as a fiduciary or trustee for the customer.

To the authors’ knowledge, no relevant case law, legislation or guidance from the national authorities has yet emerged to bring clarity on the subject. However, the general view on the legal validity of smart contracts is that, as long as such arrangements meet the four conditions laid down in Article 1108 of the Luxembourg Civil Code for a contract to be valid and binding, there is no reason why they should not qualify as valid and binding contracts under Luxembourg law. The four conditions under Article 1108 are:

• the consent of the parties;
• their capacity to enter into the contract;
• an object that is certain; and
• a cause that is licit.

The enforceability of a contractual arrangement requires the parties to have reached an agreement on the essential terms of the contract and with an intention to create legal relations. Luxembourg law follows the principle of technological neutrality. Therefore, the agreed-upon computer code may serve as evidence of such an agreement (Article 109 of the Luxembourg Commercial Code provides that in commercial matters, the burden of proof is governed by the principle of the free assessment of evidence and as most transactions – registration and transfer operations – carried out through DLT should be deemed of a commercial nature, the provisions of the Luxembourg Commercial Code should apply). Furthermore, the 2001 Law, the 2013 Law (as defined in 4.1.1 Regulatory Overview) and the Collateral Act 2005 expressly recognise using DLT for the purposes of issuance, transfers and collateralisation of DLT financial instruments.

The CSSF updated its FAQ on “Virtual Assets – Undertakings for collective investment” on 18 December 2023, detailing the authorisation requirements applicable to investment fund managers managing regulated or non-regulated AIFs investing directly or indirectly in virtual assets. This FAQ was further updated on 22 February 2024, clarifying to what extent a UCITS or an AIF (respectively) may invest in virtual assets. 

Currently, the only existing DLT regulatory sandbox in Luxembourg is that created by the DLT Pilot Regime Regulation (European Blockchain Sandbox). It enables a regime in which market infrastructures can obtain exemptions from applicable financial regulations to be able to use DLT for the EU trading and settlement of securities transactions, thereby promoting the development of DLT in the financial sector. The European Blockchain Sandbox released its 2023 Best Practice Report on 13 February 2024.

Luxembourg has implemented certain rules and standards applicable to the blockchain sector proposed by international bodies such as the FATF or the BIS. Some of the laws or standards that Luxembourg has implemented or is in the process of implementing include the following.

The transposition of AMLD5 into national law introduced new AML/CFT rules for VASPs and custodian wallet providers. As a result, VASPs and custodian wallet providers must:

• register or obtain a licence from the relevant authorities;
• conduct customer due diligence and verify the identity of their customers;
• monitor and report suspicious or large transactions involving virtual assets; and
• comply with other AML/CFT obligations and standards.

Luxembourg transposed AMLD5 in February 2020, with some additional provisions that go beyond the EU minimum standards, such as requiring VASPs to:

• obtain a payment institution or electronic money institution licence from the CSSF; and
• comply with the same prudential and conduct of business rules as other payment service providers.

Luxembourg follows the FATF Recommendations and the FATF Travel Rule, which are international standards for AML/CFT. These rules require VASPs to exchange information on the originator and beneficiary of virtual asset transfers above a certain threshold, as well as to co-operate with authorities and other VASPs.

The CSSF is the public authority responsible for supervising and regulating the financial sector in Luxembourg, except for the insurance sector, which falls under the supervision of the Commissariat aux Assurances. The CSSF supervises, regulates, authorises, informs, carries out on-site inspections (where appropriate) and issues sanctions. Moreover, it is in charge of ensuring transparency, simplicity and fairness in the markets of financial products and services, and is responsible for the enforcement of laws relating to financial consumer protection and the fight against money laundering and terrorist financing.

The authors are not aware of any material change in the CSSF’s approach following the notable bankruptcies in the blockchain sector in 2022.

The authors are not aware of trade groups performing regulatory or quasi-regulatory roles in Luxembourg. However, the ABBL and the Luxembourg Capital Markets Association (LuxCMA) regularly provide legal and regulatory positions applicable to the fintech sector.

The CSSF has created an Innovation Hub, consisting of a dedicated point of contact for any person wishing to present an innovative project or to exchange views on the major challenges faced in relation to financial innovation in Luxembourg.

The Luxembourg House of Financial Technology (LHoFT) is a not-for-profit initiative supported by the public and private sectors to drive innovation and digitalisation in Luxembourg’s financial services industry. As the national platform and central hub for fintech, its goal is to foster collaboration, encourage experimentation and support the development of cutting-edge financial technology solutions.

The authors are not aware of any past or ongoing judicial decisions in Luxembourg that would have specifically impacted on the interpretation or the application of the Luxembourg legal regime for the use of blockchain.

The CSSF published Circular 23/832 regarding the application of ESMA guidelines on standard forms, formats and templates when applying for permission to operate a DLT market infrastructure in accordance with the DLT Pilot Regime Regulation.

Please refer to the White Paper published by the CSSF in January 2022.

The Luxembourg Institute for Standardisation, Accreditation, Safety and Quality of Products and Services (ILNAS) has also published a full dedicated report on blockchain technology and the legislative framework (in June 2021 – available here).

Finally, some market participants have created the “Luxembourg Blockchain Lab”, which aims to support actors that are involved in blockchain technology and to promote such technology in Luxembourg. The Luxembourg Blockchain Lab organises events allowing market participants to meet blockchain experts and to better understand the applicable legal framework.

Those elements should help Luxembourg market participants to better understand what is permitted when using blockchain technology.

Luxembourg has not yet implemented any specific direct or indirect tax rules or guidance for blockchain-based transactions, except for:

• a Circular dated 26 July 2018 (LIR No 14/5-99/3-99bis/3) that clarifies the Luxembourg income tax treatment of income derived from investing and mining in cryptocurrencies; and
• a Circular dated 11 June 2018 (No 787) that clarifies the Luxembourg VAT treatment of cryptocurrencies.

Although cryptocurrencies are assimilated with traditional currencies from a VAT perspective, this is not the case from a direct tax perspective. From a direct tax standpoint, cryptocurrencies are treated as intangible assets.

While the above-mentioned Circulars provide some clarity on the direct tax and VAT treatment of cryptocurrencies, there is still a lot of uncertainty regarding the tax treatment of other instruments that rely on blockchain technology, such as NFTs. The Luxembourg government is frequently urged to update the current law to create a secure legal and tax framework for investors in blockchain-based transactions in Luxembourg. Please refer to the Luxembourg Policy Recommendations of April 2023 by the Luxembourg Blockchain Lab.

No specific ESG/sustainable finance requirements are applicable to digital assets in Luxembourg.

“Data privacy” is not a term commonly used in Luxembourg, and is often used interchangeably with the term “data protection”. The main legal framework for data privacy and data protection in Luxembourg is the General Data Protection Regulation (GDPR), which is an EU Regulation that sets out the principles, rights and obligations for the processing of personal data (ie, information relating to an identified or identifiable natural person).

The authors are not aware of any specific case law or enforcement action in Luxembourg regarding the compliance of blockchain-based products or services with the GDPR. However, the CNPD, Luxembourg’s data protection authority, has referred to a study for the European Parliament that identified potential conflicts between blockchain and the GDPR on its website. The CNIL, the French data protection authority, also issued a guidance paper in September 2018 on how to use blockchain responsibly in relation to personal data. The CNPD is likely to consider these publications when applying the GDPR to blockchain-based products or services. Furthermore, the EDPB, the EU body for data protection, plans to publish guidelines on blockchain according to its work programme for 2023–2024.

Processing personal data with blockchain-based products or services may present some challenges under the GDPR due to the specific features of blockchain technology. These include its distributed, decentralised and immutable nature, which complicates the identification, allocation and enforcement of the roles and responsibilities under the GDPR of the various contributors (such as users, developers and miners). The “type” of blockchain used also plays a significant role – ie, whether it is public, permissioned or private. Despite these challenges, data controllers and processors need to be clearly defined, and data subjects need to have an accessible point of contact to exercise their rights effectively.

Blockchain is designed to prevent any modification or deletion of data. This feature conflicts with the rights to rectification and erasure, as per Articles 16 and 17 GDPR. The CNIL suggests that cryptographic solutions, such as keyed hash functions, might produce an effect equivalent to the actual deletion of data. However, it urges that this must still be evaluated in light of the requirements of the GDPR.

Additionally, the rules for transferring data outside the European Economic Area are hard to comply with, as data controllers generally have no control over the location of miners, especially in public blockchains.

Given these challenges, companies should carefully assess whether blockchain is the most suitable technology for their data-processing purposes, in accordance with data protection by design and by default principles.