Contributed By Homsy Legal
Following the Bill of Law 7363, approved on 14 February 2019, a new provision entered into force notably allowing securities to be registered and held via a distributed ledger (issuance of securities was never previously discussed in earnest, contrary to the holding and transfer). As a result, the provision provided legal certainty to markets players, allowing projects to commence in the following months. Most Luxembourg players in the field believe in the capability of distributed technologies to assist the holding, clearing and settlement of securities.
More generally, several new steps to support blockchain projects in the countries have been made. In May 2019, the government via its Ministry for Digitalisation announced the creation of the first public sector blockchain in collaboration with Luxembourg University to develop solutions for the benefit of citizens and businesses in Luxembourg and to contribute in improving transparency, reliability and security of public sector digital information systems and processes via a collaboration between the States and its municipalities. With this in mind, a Hackathon Challenge is planned for September 2020 (subject to the unpredictable factors of the global pandemic) to come with the best innovative Proof of Concept DApp based on the Public Sector Blockchain and code a working demo.
In December 2019, five leading actors active in the blockchain space joined forces to support Luxembourg's economy. This initiative, called Blockchain Lab, includes:
In January 2020, the Luxembourg blockchain and DLT Association Lëtzblock invited its members to participate in the creation of its own blockchain. The project "learning by doing" is a non-profit experiment for the general public to deploy a network on its own.
While there is no doubt that the COVID-19 crisis will have an unprecedented impact on society, the crisis has also raised awareness of the importance of digitalisation and security. In addition, the crisis has also highlighted the advantages of the blockchain in terms of data verification.
In addition to the initiatives described above, the Luxembourg ecosystem has seen different business models flourish given the unique and international position of Luxembourg to ally traditional finance (funds and credit institutions) and emerging digital finance (payments institutions, fintech and regtechs).
Luxembourg is one of the most important places when it comes to fund management. It is, therefore, obvious that the market has seen the blossoming of a whole series of models linked to the fund industry.
Among the business models to support funds via blockchain, in March 2020, a permissioned Ethereum-based platform for the investment funds professionals called FundsDLT has been launched. It is an international platform for fund industry players to interconnect with each other. The company includes major actors and aims to integrate fund industry players (eg, asset managers, distributors, asset servicers, etc) and to optimise costs by streamlining a number of activities along the fund distribution value chain and thus reduce costs for the benefit of investors, regardless of their domicile or the funds’ incorporation. While designed for professionals, it aims at providing necessary transparency for end investors.
In addition to this platform the funds industry has seen several projects for funds tokenisation emerge. Most of the projects are aimed at offering investments to a limited circle of qualified investors (ie, professionals under MIFID II or the Prospectus Regulation).
Aside from the funds industry, Luxembourg is also known for having seen the first regulated crypto-exchanges on its soil (ie, Bitstamp and bitFlyer Europe). Both exchanges have been licensed as Payment Institutions under the European PSD2 framework (the second Payment Services Directive), under the supervision of the domestic regulator the Commission de Surveillance du Secteur Financier (CSSF).
With the development of smart contracts applied to tokenised assets, new domestic companies have formed to provide solutions in relation with issuance, transfer and/or management of tradable digital assets/security tokens, such as tokenised loans, structured notes, equity, and funds. Notable mentions include Neo Facto, Tokeny or Stokr. A first tokenisation in the real-estate field occurred during the year of 2019.
Finally, a Luxembourg start-up called Stampify specialised in decentralised corporate governance has launched its first solution in March 2020. Faced with COVID-19 and the subsequent containment, the business helped companies willing to hold remote ordinary or extraordinary meetings remotely using it’s "digital boardroom" tools.
Outside the financial area, a start-up called Ibisa Network has built a platform enabling farmers to share risks in a transparent and cost-efficient way, harnessing the use of blockchain, satellite earth observation data and index-based risk modelling. The company announced in a press release in January 2020 that it had signed a contract with the European Space Agency to develop its insurance platform and operations notably in India.
Luxembourg being a Member State of the European Union, amendments related to the New Prospectus Regulation as of July 2019 have been taken into consideration. The new provisions from the Prospectus Regulation impacts notably the public offer of securities. The exceptions drawn in the Prospectus Regulations (ie, qualified investors, limited number of investors (a maximum of 150), total consideration of at least EUR100,000, etc) played a considerable role in the proof of concepts in the market, being most of the time preferred to a retail investors profile. However, no specific regulatory regime in Luxembourg has been issued with regards to crypto-assets in relation with the Prospectus Regulation.
The Fifth Amendment of the Anti-Money Laundering Directive
The transposition of the fifth amendment of the Anti-Money Laundering Directive, Directive 2015/849/EU (AMLD5) on May 30, 2018 was to be implemented as of 10 January 2020. On 15 January 2020, the domestic regulator, the CSSF, issued a communication related to virtual assets and virtual asset service providers (VASPs) referring mostly to the amended FATF guidance (see 2.2 International Standards) and raising awareness on the upcoming domestic implementations. On 25 March 2020, the Bill of law 7467 was adopted allowing the necessary provisions to ensure the transposition of the AMLD5 (in addition to the Bill of Law from December 2018 and into force in June 2019 setting the Beneficial owners register applicable to Luxembourg companies including VASP, and crypto exchanges and the Bill and) and amends the amended Act of 12 November 2004 on the fight against money laundering and terrorist financing (the "AML/CFT Act") to include special provisions applicable to virtual asset service providers.
Bill of Law 7467
The Bill of Law 7467 designates the CSSF as the supervisory authority for VASPs. With the new provisions in force, VASPs now have to comply with the anti-money laundering and counterfeiting terrorism provisions and EU regulation on transfers of funds.
According to this bill of laws, virtual asset service providers must register with the CSSF and send to the latter an application containing in particular a description of the risks of money laundering and terrorist financing to which the applicant will be exposed and the internal control mechanisms that the applicant puts in place to mitigate these risks and to comply with the professional obligations defined in this law and in Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds and repealing Regulation (EC) No 1781/2006, or in the measures taken for their implementation. It is worth mentioning that AMLD5 extends the scope of application, to subject all providers of exchange services between virtual and legal currencies, as well as providers of custody portfolio services, to professional obligations in the fight against money laundering and terrorist financing. However, the transposition law goes beyond AMLD5 requirements and take already into account recommendations made by The Financial Action Task Force FATF in 2019 (see 2.2 International Standards).
The aforementioned bills amending the anti-money laundering and counterfeiting terrorism obligations in Luxembourg take into consideration the recommendations issued by the Financial Action Task Force (FATF) regarding VASPs and virtual assets.
In a communication dated April 2020, the CSSF, the new supervisory authority for VASPs, reiterates its warning regarding the application of the Interpretative Note to the FATF Recommendation 15 on New Technologies taking account of VASPs. Indeed, the adoption of the Laws of 25 March 2020 (the "March 2020 Laws") amending the AML/CFT Law defined a broader scope of application by taking over the cases of application defined by the FATF. Accordingly, VASPs are considered to be any entity that acts for or on behalf of such customers with the following activity:
For the time being, there is no public consideration made of the implementation of the latest reports drawn up by the Financial Stability Board (FSB) or the International Organisation of Securities Commissions (IOSCO) despite the fact that IOSCO has issued a report on "Issues, Risks and Regulatory Considerations Relating to Crypto-Asset Trading Platforms" for which the Association of the Luxembourg Fund Industry (ALFI) commented.
Luxembourg is actively involved in the development of technical standardisation in the field of blockchain and DLT via its national ISO/TC307 study committee, which monitors international standardisation work in the field of blockchain such as the definition of terminology, taxonomy, security management of digital asset custodians, etc.
Following plenary meetings of ISO technical committee ISO/TC 307 "blockchain and distributed ledger technologies", the national technical committee of Luxembourg meets regularly to take stock of new points of attention such as interoperability or archives/record management.
The main regulatory bodies are the CSSF, which supervises the professionals and products of the Luxembourg financial sector (eg, investment firms, investment funds, securities markets, payment institutions, audit profession) with the exception of significant credit institutions (falling under the responsibility of the ECB). With the adoption of the Bill of Law on 25 March 2020, amending the anti-money laundering law, the CSSF became the anti-money laundering and counterfeiting terrorism supervisory body for VASPs.
In addition, the Commissariat aux Assurances (CAA) is the competent supervisory authority for the insurance sector in Luxembourg including insurance undertakings, reinsurance undertakings, a number of pension funds, professionals in the insurance sector, and insurance and reinsurance intermediaries (agents and brokers). Depending on the business model developed by market participants, their activities may be subject to one or the other of the regulatory bodies, or even both.
To date, there are no self-regulatory organisations or trade groups which, by law, perform regulatory or quasi-regulatory roles with respect to businesses or individuals using blockchain in Luxembourg. Only the competent authorities in sectoral matters perform regulatory roles (ie, in finance, insurance, financial intelligence).
Nevertheless, business associations (particularly in financial matters) meet regularly to discuss the subject.
In this respect, the work of the Association of the Luxembourg Fund Industry (ALFI) is particularly noteworthy where the Working Group Blockchain & Crypto Currencies has notably been focusing on the development of whitepapers in the field, as well as a collaborative book on Tokenisation and digital custody in the investment fund domain.
The same applies to the Luxembourg Bankers’ Association (ABBL) having established a Digital Banking and FinTech Innovation Cluster in which reflections on the implementation of infrastructure using Blockchain or DLT or on products using the technology are periodically discussed.
Finally, a discussion paper on blockchain and crypto-assets was prepared by a working group of the Luxembourg Association of Compliance Officers (ALCO Working Group 52) composed of compliance officers and representatives of the industry, which reflects the working group's understanding as of May 2019. The document provides a unique view from compliance officers on risk and regulation related to crypto and DLT businesses, offers a potential classification of business models (early adopters, miners, traders, VASPs) along with guidelines regarding client due diligence based on these business models. In addition to the usual documents required for a client to be onboarded, the document lists additional information and documents that could be required when dealing with a specific business in blockchain technology and/or in crypto-assets.
The discussion papers cover both due diligence from the bank and the funds industry perspective, adapting to their specific requirements.
To date, there are no court decisions concerning this technology that have had a significant impact on the use of the technology or its applications (cryptocurrencies, crypto-assets, DApps, etc). Nevertheless, the interpretation or establishment of the legal regime applicable to the use of blockchain in Luxembourg is made on the basis of an interpretation of the existing framework (domestic and European) and the sanctions provided for by the relevant legal provisions.
In particular, the criminal sanctions provided for by GDPR can be considered in a context where the very characteristics of the technology do not always prove to be perfectly adequate with the fundamentals of regulation such as the right to be forgotten or the qualification (and liability) of joint data controllers.
To date, there are no specific enforcement actions in Luxembourg that have helped market participants better understand the “regulatory perimeter” of permitted and/or prohibited activity utilising blockchain.
Nevertheless, authorities (such as the Luxembourg Cellule de renseignement financier (CRF)) occasionally intervene publicly, enabling market players to exchange and understand the authorities' positions.
For the first time in Luxembourg, the Luxembourg Blockchain association Lëtzblock hosted a conference where professionals and financial agencies from Luxembourg (CRF), France (Tracfin), and the US (FinCen), shared their visions of anti-money laundering and counterfeiting terrorism frameworks for crypto-assets, described use cases, and explored the possibilities and challenges of anti-money laundering and counterfeiting terrorism measures. The conference covered current practices, as well as sharing and exchanging thoughts on future frameworks that would be applicable for both traditional institutions and VASPs involved in the business related to DLT and Blockchain.
There is no regulatory sandbox, fintech desk or other similar designation established by a regulatory authority specifically to support blockchain projects. Nevertheless, the CSSF in its latest communication regarding VASPs registration on April 2020, requested from entities intending who offer any of the virtual asset services described in the Laws of 25 March 2020 (see 2.2 International Standards) to register beforehand as a VASP and comply with the professional obligations and the conditions described in the anti-money laundering and counterfeiting terrorism Law, as amended by the March 2020 Laws. It is, however, unclear whether the proactive registration beforehand would have the same consequence as a Sandbox (meaning to allow VASPs to experiment business cases in a controlled environment under the regulator's supervision).
Initiatives to Support Blockchain Projects
There are a series of private or public/private initiatives that aim to support wholly or partly blockchain-based projects.
The Blockchain Lab is a cross-sectorial consortium supported by the minister for Digitalisation intends to develop a European Blockchain Lab for research, education, and industrial projects in blockchain where industry could test commercial Proof of Concepts by the end of 2020 (see 2.1 Regulatory Overview). Infrachain is a sandbox in the sense that it is a pan-European organisation supported by the Luxembourg government that enables its members (all blockchain-based projects) to develop projects for operational blockchain use.
LHoFT is a dedicated start-up centre to foster innovation in Financial Technology and supported by the Ministry of Finance. In addition, the ministry of Economy supports the development of the data-driven economy in Luxembourg via it’s Luxembourg Digital Innovation Hub, which is part of the pan-European network of Digital Innovation Hubs.
Via a circular published in July 2018, the Administration des contributions directes issued a position on how to treat virtual currencies in the context of direct taxation. On this basis, the Tax authorities distinguish between mining of a virtual currency (where income obtained is derived from a commercial activity and taxed as such), virtual currency exchange platform (where income is also derived from a commercial activity and taxed as well as such) and the purchase and sale of virtual currencies, which are considered as transactions (and as such as capital gains if hold more than six month and exceeding a particular amount). Since 2018, no additional position was issued, and cryptocurrencies remain subject to taxation based on existing rules.
In the context of VAT, the circular from June 2018 which exempt some operations relating to cryptocurrencies remains applicable.
The Luxembourg government supports the development of projects based on the blockchain at the level of different ministries (eg, Ministry of Economy, Ministry of Finance). See 2.1 Regulatory Overview and 2.7 Regulatory Sandbox.
In light of recent developments in the markets relating to STOs, the question of ownership often arises. Tokens may offer rights (partially or wholly) to the ownership of a product. Tokenised assets may encompass rights such as ownership or property toward the issuer.
Luxembourg does not have a specific framework which would specifically deal with crypto-assets. However, As European regulations are applicable in Luxembourg, Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments, (MIFID II) is applicable to tokens as well as the Luxembourg Law of 5 April 1993 on the financial sector. It defines the concept of financial instrument, and more specifically transferable securities (Article 1(33) 1993 Law). To qualify as having transferable ownership, tokens must be traded on an open market (few tokens have restricted rights).
Like many European countries, Luxembourg has adopted a position of technological neutrality in its legislative approach, legislating only when it comes to bringing clarity to the legislative framework. This is what was decided when Luxembourg adopted in February 2019, an additional provision (Article 18bis) to be integrated in its current law from 1 August 2000 concerning the transfer of securities. While not specifically addressing the ownership, it however provided clarity that securities transfers registered on distributed electronic registers or databases are to be considered as transfers between securities accounts.
A parallel can be drawn between this new provision in Luxembourg and the Ordinance No 2017-1674 of 8 December 2017 (the "Blockchain Ordinance") issued in France.
Based notably on Luxembourg Law of 5 April 1993 on the financial sector and EU legislation and regulation, crypto-assets may qualify as financial instruments, electronic money or units in collective investment undertakings.
The characterisation of these digital assets relies on the specificities of the token and the features embedded in them. As such, cryptocurrencies such as BTC, ETH, LTC are considered as electronic money under EMD2 (Directive 2009/110/EC of the European Parliament and of the Council of 16 September 2009 on the taking up, pursuit and prudential supervision of the business of electronic money institutions) when the crypto-assets is electronically stored, has monetary value, represents a claim on the issuer, is issued on receipt of funds for the purpose of making payment transactions and accepted by other persons than the issuer.
The same will apply in accord with PSD2 (Directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market) if the crypto-assets (or cryptocurrencies, or payment token) qualifies as electronic money.
Luxembourg Law 20 July 2018
The Luxembourg Law of 20 July 2018 on the transposition of PSD2 and amending the law of 10 November 2009 on payment services does not specify more than the content of EMD2 or PSD2. The CSSF has also taken a position on virtual currencies. According to this Luxembourg authority, virtual currencies are a means of exchange or digital presentations of unsecured securities which are neither issued nor controlled by central banks and whose supply and/or demand may be limited.
Unlike a currency, virtual currencies are not legal tender and do not represent a means of exchange whose value is guaranteed by a central bank. Their value is therefore based solely on the confidence that holders and users place in the acceptance of virtual currencies as a means of exchange by other natural or legal persons. Virtual currencies are therefore not subject to any specific regulation at the national or European level and do not offer any legal protection to investors.
The authority reiterates the AMLD5 definition of virtual currencies as "The digital representation of a security which is not issued or guaranteed by a central bank or a public authority, which is not necessarily linked to a legally established currency and which has no legal status as a currency or money, but which is accepted as a means of exchange by natural or legal persons and which can be transferred, stored and exchanged by electronic means".
However, as stated in 3.1 Ownership, a token by its features can be considered as “transferable securities” when meeting Article 4 (1) (44) of MiFID criteria (ie, transferability, standardisation, negotiability on capital markets, and exclusion as payment instrument). The preliminary work made in 2019 during the adoption of art 18bis of the law of 1 August 2000 concerning the transfer of securities show however a willingness from Luxembourg to ensure a broad definition of securities in order to keep the concept flexible to market developments. Whether tokens qualify as units of investment funds depends on what is intended to be offered and to which type of investors (ie, alternative investment funds and UCITS funds).
As mentioned, the exceptions drawn in the Prospectus Regulations (ie, qualified investors, limited number of investors, total consideration of at least EUR100,000, etc) are taken into consideration when considering the application of the Prospectus Regulation, as well as situations where investment funds may be supervised by the Commission de Surveillance du Secteur Financier CSSF under the Luxembourg securitisation law of 2004. The Luxembourg authority here also quickly took the position to warn that virtual currency investments are not suitable for all types of investors, and investment objectives.
In general, market participants tend to adopt the most used classification to wit: cryptocurrencies (or payment) tokens, security tokens, utility tokens, and hybrids therein. There are few participants considering tokens as commodities. To our opinion investment tokens and stablecoins should not be considered however as falling under the security token category as often happens.
In 2020, the Luxembourg company NEOFACTO mentioned developing a stablecoin solution called TOKEUR. The solution would allow both payments and OTC operations management via smart contracts.
Luxembourg has been applying to cryptocurrency companies the regime applicable to payment companies, based on a European directive EMD2 or PSD2 (and the 2009 law relating to payment services) depending on the business model chosen by the company when cryptocurrencies and fiat are exchanged. These companies are licensed under the CSSF and follow the regulatory requirements expected (internal controls, customers due diligence, anti-money laundering and counterfeiting terrorism requirements, etc).
In this latest statement, the CSSF reiterated that virtual currencies are means of exchange or digital representations of unsecured securities that are not issued or controlled by central banks and of which supply and/or demand may be limited. Unlike a currency, virtual currencies have no exchange rate and do not represent a means of exchange whose value is guaranteed by a central bank. Nevertheless, there is nothing to prevent private players from paying in cryptocurrencies and determining the terms and conditions contractually. However, in these cases the legal consequences will be those attached to the euro, the only legal tender.
As of 1 October 2019, PwC Luxembourg has declared accepting bitcoin payments in order to support its clients, although it is unclear if any clients have yet used this payment method.
There are no specific regulations to date that apply specifically to NFTs.
Custodial exchanges in the Luxembourg region principally include bitFlyer and Bitstamp, both regulated as payment institutions. These exchanges principally operate the in-spot exchange markets, focusing on fiat-crypto pairs (eg, BTC/EUR, ETH/EUR, LTC/EUR) but also with some additional crypto-crypto pairs (eg, ETH/BTC). These exchanges both operate both an "open order book" model, which connect buyers and sellers and match their orders for a commission fee, and also a brokerage model where buyers or sellers both transact directly with the exchange, which maintains its own inventory to offer this service.
At time of writing, neither bitFlyer nor Bitstamp offer leveraged or margin trading facilities, although bitFlyer’s parent company in Japan offers leveraged trading to its Japanese customers using a CFD structure and Bitstamp is also exploring offering leverage in partnership with Silvergate Bank to select institutional customers. Typically, such activity would require a new licensing arrangement and are not covered under the Payment Institution license.
There are no notable domestic DEX projects yet.
The primary on-ramps and off-ramps in Luxembourg are the two regulated custodial exchanges mentioned above. In both cases, users typically exchange Euros for cryptocurrencies by first crediting their trading account via SEPA or SWIFT transfer, and thereafter placing an order. Alternatively, these exchanges offer a purchase option via credit / debit cards, or in bitFlyer’s case including popular European payment methods such as SOFORT, giroPay, and IDEAL (with the assistance of an integrated payment processor).
Regulations applicable to money transmission in Luxembourg will be based on the qualification of crypto-assets. Should crypto-assets be considered as electronic money, EMD2/PSD2 will apply. On the contrary, should crypto-asset be considered as a financial instrument, the exchange would be falling under MIFID II consideration, as well as MAR II (see 4.4 Regulation of Markets). In addition, anti-money laundering and counterfeiting terrorism consideration will apply (see 4.3 KYC/AML).
As described in 2.1 Regulatory Overview and 2.2 International Standards, the laws of March 25, 2020 extended the scope of the Anti-Money Laundering and Counterfeiting Terrorism to Virtual Assets Service Providers.
The following business models need to register with the CSSF an abide by KYC/AML requirements:
As communicated on 9 April 2020, any entity, including any entity already licensed/registered by a competent authority and in particular licensed financial institutions, which already offers any of the virtual asset services described above as of 30 March 2020, has to promptly notify the CSSF thereof by email; submit a registration file to the CSSF in order to be specifically registered as VASP (a Virtual Asset Service Provider) as soon as possible and at the latest for 30 May 2020; and comply with the professional obligations and the conditions described in the AML/CFT Law, as amended by the March 2020 Laws, as from 30 March 2020.
Similar to the compliance framework in place for regulated entities, these entities will have to abide by measures and in the same way other obliged entities under the supervision of the CSSF.
One has to consider that exchange platforms and other VASPs may have been already under the supervision of the CSSF as licensed under EMD2 or PSD2 when facilitating exchange between fiat and crypto. They perform transaction monitoring, report suspicious transactions to the Cellule de renseignement financier (CRF), which is Luxembourg's Financial Intelligence Unit, and proceed to due diligence verification in accordance with policies in place.
When addressing AML requirements, Luxembourg opted to implement The Financial Action Task Force FATF Recommendations as enunciated under the Risk Based Approached on Virtual Assets and Virtual Assets Providers, going beyond the requirement set by AMLD5 (ie, providers engaged in exchange services between virtual currencies and fiat currencies, Custodian wallet service providers and prepaid cards for fiat/cryptocurrencies exchange).
Blockchain and Crypto-assets
Finally, although issued before the issuance of FATF Risk Based Approach in July 2019 or the adoption of the new AML provision in February 2020, a discussion paper on blockchain and crypto-assets prepared by a working group of the Luxembourg Association of Compliance Officers (ALCO Working Group 52) has specifically analysed the potential requirement related to five types of clients defined by their respective activities related to decentralised technology when onboarding clients: the early adopters/experts, the miners, the traders/investors, the virtual asset service providers, and the ICO/STO issuers. Aside from the general consideration related to KYC (name, profession, etc), the paper details risk and regulation to elaborate a tailor-made each of the business type.
For instance, clients considered as early adopters having already crypto-currencies could be requested to provide specific indication about the client technical competences and/or expertise in connection with Blockchain or background in connection with crypto-assets, such as the context, history and reasons for the interest in this area and the link with crypto-currencies, a description on the clients’ activities including if applicable the business model involving crypto-assets or DLTs, address(es)/wallet(s) where the client holds the crypto-assets, a trading history track record including for instance records of all transactions made for the purchase/sales of cryptocurrencies to be obtained from the broker/trading platform or verified in the wallet or adequate tool and a verification of the client and its address(es)/wallet(s) where funds are originated. The compliance officers there underline for instance in the discussion paper that transactions accepted should be those made to a VASP where the history of transactions can be presented.
The paper underlines also that due to complexities related to obtain a transaction’s history and to the extent possible, the working group recommends to avoid clients using when obscuring techniques such as mixing, conjoining, tainting, peeling, blending, usage of dark wallet/dark pools, or zero coin/cash are detected.
Thus, for each client's classification, the discussion paper could provide suggestions as to how to define KYC and AML requirements for the categories, although those are to be adapted to the upcoming practices developed by the new regulatory framework for VASPs in Luxembourg.
Markets for digital assets in Luxembourg abide by the same regulation as other European Union Member States. Should a crypto-asset qualify as a financial instrument under MIFID II, the MAD II (MAR/CSMAD) would apply. However, to apply, crypto-assets need to be traded or admitted to trading on a trading venue. Open questions remain whether miners have considerable influence to manipulate via abusive behavioural trading activities the price of such cryptofinancial instruments.
The European Securities and Markets Authority ESMA has recently recommended to analyse in any further MAR revision whether the regulatory framework related to Market Abuse is adequately addressed for cryptofinancial instruments.
To our opinion, as to the short selling regulation, its application has limited application to crypto-asset as of today. It would request to list cryptofinancial instruments that are capable of triggering a net short position, as described in the Annex I of the Commission Delegated Regulation.
It is to be reminded that crypto-assets traded on the exchange platform such as Bitstamp or bitFlyer are considered as electronic money and not financial instruments under MIFID II (and consequently MAD II or the Short Selling Regulation).
There is no specific regulation in Luxembourg regarding the use of crypto-asset as collateral in transactions.
In any case, re-hypothecation of collateral supposes exchanges in Luxembourg dealing with financial instruments (eg, collateral in repurchase agreements (repos) or derivative transactions), which are not the case at the moment.
Since March 2020, safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, including custodian wallet services, are falling under the Articles 1 (20c) and 7-1(1) of the AML Law. However, the registration required by the CSSF does not necessarily encompass rules outside the scope of AML CFT, except for entities already falling under CSSF supervision under other regulation.
With regards to wallet providers, there is no specific legislation that addresses for instance vault or wallet providers or differentiate between online and offline storage solutions, despite practical risks for VASPs holding private keys on behalf of their customers to lose control of the assets.
However, in cases where wallet providers fall under other regulations given their activities (such as exchanges), regulatory requirements related to cyber-risks are applicable to them. In this respect, the compliance officers have proceeded in their discussion paper on blockchain and crypto-assets to a brief risk analysis relating to wallet providers.
Similar to the tokens’ classification, the current legal framework in place in Luxembourg does not regulate Initial Coin Offerings and rules applicable will follow the features embedded in the coin or more generally the Token. It should be a case by case analysis.
As described in 3.2 Categorisation, depending on the qualification, tokens that qualify as financial instruments will then fall under MIFID II and the Prospectus Regulation; tokens that qualify as electronic money will fall under either EMD2/PSD2 or as a unit of collective scheme. In this perspective, the law of 5 April 1993 on the financial sector (see, for instance, Article 24-1), and the law of 16 July 2019 on prospectuses for securities may be relevant (see the CSSF, communiqué de Presse 19/37).
Given the risks for consumers, the regulator communicated the recent warnings issued by the European Securities and Market Authority at European level and by the International Organization of Securities Commissions (IOSCO).
The regulations specified in the previous point would always remain the same.
However, and depending on the business model and parameters set when the IEO fall under, a third party may fall under Part I, Chapter 2, Section 2, Sub-section 1 of the Law of 5 April 1993 on the financial sector, and be considered as a professionals of the financial sector subject to the CSSF supervision, such as Investment advisers (Article 24), brokers in financial instruments (Article 24-1), commission agents (Article 24-2), distributors of units/shares in UCIs (Article 24-7) or financial intermediation firms (Article 24-8).
In line with the European regulatory framework for investment funds, Luxembourg will see its legislation as a general distinction between alternative investment funds and UCITS funds (for which more protective and therefore stricter rules for retail investors apply). Luxembourg provides a more flexible framework for alternative investment funds compared to other EU Member States.
There is a wide scope left to the discretion of the initiators of tokenisation projects. Further, depending on the number of investors and the amounts involved, the fund will not necessarily be regulated or subject to CSSF supervision.
There is no specific regulation related to broker-dealers for digital assets. However, professionals dealing with crypto-assets qualifying as financial instruments or electronic money by buying and selling on behalf of customers will require a licence under the law of 5 April 1993 on the financial sector (see 5.2 Initial Exchange Offerings)
There are no laws, regulations or binding judicial decisions addressing the legal enforceability of private contractual arrangements made in whole or in part utilising agreed-upon computer code that executes across multiple “nodes” on a blockchain-based network. However, smart contracts given their automated execution may raise concerns related to requirements that the will of the parties are expressed in a formal manner for the validity of certain acts. For instance, it may be doubtful to consider that an automated self-executing software may be sufficient to be deemed as an informed consent under Article 1108 of the Civil Code.
Most of the time, parties will agree on a formal understanding such as a contract before the execution of the smart contracts embedded in the solution. However, the situation is not the same when users will directly use the solution by agreeing with the Terms and Conditions.
There has been no case in Luxembourg involving developers’ liability. However, in our opinion, liability is defined in case by case depending on the technology used. For instance, it is necessary to define whether the developers are working on information on-chain or off-chain, for which some of the information can be controlled and rectified. Furthermore, in many cases developers are not involved in the operation of a blockchain-based network at all; they may have instead developed code that was open-sourced and used by others. In such cases, developers would not be considered "fiduciaries".
Similarly, one needs to draw a distinction between "developers" and "operators" of technology. Case in point would be the so-called "Coin Join" mixing technology that is integrated into Wasabi Wallet and is used to obfuscate bitcoin transaction history. It was not the developers of Coin Join, but the operators of the Coin Join servers actually conducting the mixing activities that became the targets of investigation.
Working on a permissioned blockchain or private blockchain may have different implications than acting and working on a public blockchain. The design of the governance methods chosen will impact developers' liability.
There are no decentralised financial (DeFi) platforms matching for instance borrowers and lenders of digital assets that would show any links with Luxembourg.
In view of the evolution of the Luxembourg market for digital assets, there are no public projects currently where a lender would take an effective security interest (or the equivalent) in digital assets pledged as collateral for a loan.
In general (although a case by case study is necessary) lending instruments will most likely qualify under the Luxembourg law of 5 August 2005 on financial collateral arrangements.
Since March 2020, safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, including custodian wallet services fall under the requirement of the AML Law. As such, custodians in virtual assets are required to register with the CSSF and abide by the anti-money laundering and counterfeiting terrorism requirements. In addition, transfer of virtual assets is falling within the same category. Professional investors committing to transfer to a digital assets custodian in which they have invested, will be submitted to the application of the Travel Rule (ie, Interpretive Note to the Financial Action Task Force FATF Recommendation 15 on New Technologies taking account of VASPs).
The General Data Protection Regulation (EU 2016/679) (GDPR) is directly applicable in Luxembourg. In addition, Luxembourg adopted a Law of 1 August 2018 on the protection of individuals with regard to the processing of personal data.
The fundamental characteristics of blockchain such as distribution, transparency, and perpetual ledger operate in contradiction with fundamentals of GDPR such as data minimisation, purpose limitation, storage limitation, or data subjects essential right.
Experience shows that the application of GDPR to blockchain technology must be done on a case-by-case basis and with a detailed analysis.
First, the fact that a project uses a public blockchain, a public but permissioned blockchain, or a private blockchain does not imply the same consequences in terms of the handling of data, qualification of (joint) data controllers and data processors, preservation of data subjects rights, or a data protection impact assessment to be potentially done.
And even within a public blockchain denomination, projects may use different types of governance (PoW, PoS, etc) adapted or not to fit the project.
Besides, projects may in some respects allow writing data off-chain while others will not or will only allow it with safeguards and permissions.
Furthermore, the processing of pseudonymised data must be analysed very carefully. It is not simply a matter of establishing whether the public key and transactional data are published, but it is also important to know the type of encryption used, the hashing method used, and whether there are any obscuring methods. If there are smart-contracts, it will also be necessary to study precisely the technique used in the encryption and the links between the different steps
Data Protection is embedded either in regulation such as GDPR for privacy purposes, or from a regulatory perspective for data integrity and cyber-resilience for professionals of the financial sector subject to CSSF supervision.
Mining is allowed. At time of writing there are no regulations that are directly applicable to PoW mining.
At time of writing, there are no notable "staking as a service" businesses existing in Luxembourg (although there are some private stakers/validators), nor are there any specific regulations that are directly applicable.