Crypto & Blockchain Company Setup & Structuring in Luxembourg

Luxembourg is one of the few EU jurisdictions where a crypto or blockchain company can simultaneously access the EU single market, benefit from a mature financial regulatory framework, and operate under a legal system that has explicitly addressed virtual assets since the early years of distributed ledger technology. The Grand Duchy transposed the EU';s Markets in Crypto-Assets Regulation (MiCA) and the Fifth and Sixth Anti-Money Laundering Directives ahead of many peer jurisdictions, and its regulator, the Commission de Surveillance du Secteur Financier (CSSF), has published detailed guidance on virtual asset service providers (VASPs). For founders considering a crypto or blockchain company setup in Luxembourg, the core question is not whether the jurisdiction is suitable - it demonstrably is - but which legal structure, regulatory pathway, and operational model best match the intended business.

This article walks through the full setup and structuring process: the choice of corporate vehicle, the VASP registration and licensing framework, the substance requirements that Luxembourg authorities enforce in practice, the most common structuring mistakes made by international founders, and the strategic alternatives available when a full Luxembourg structure is not yet commercially justified.

---

Luxembourg';s approach to virtual assets rests on several overlapping legal instruments. The Law of 5 April 1993 on the financial sector (Loi relative au secteur financier), as amended, provides the foundational licensing framework for financial intermediaries, and the CSSF has confirmed that certain crypto activities fall within its scope. The Law of 12 November 2004 on the fight against money laundering and terrorist financing (Loi relative à la lutte contre le blanchiment et contre le financement du terrorisme), as amended by the Law of 25 March 2020, brought VASPs explicitly within the AML/CFT perimeter and made CSSF registration mandatory for any entity providing virtual asset services in or from Luxembourg.

The Law of 1 March 2019 on dematerialised securities introduced a blockchain-native legal concept: it permits the use of distributed ledger technology (DLT) for the issuance and transfer of certain securities, giving Luxembourg a statutory basis for tokenised financial instruments that most EU jurisdictions still lack. The Law of 22 January 2021 extended this framework to cover a broader range of securities held through DLT-based systems. These two instruments together make Luxembourg uniquely positioned for security token offerings (STOs) and tokenised fund structures.

At the EU level, Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA) applies directly in Luxembourg. MiCA creates a single licensing regime for crypto-asset service providers (CASPs) across the EU, replacing the national VASP registration requirement for most activities once the relevant MiCA provisions became fully applicable. The CSSF acts as the national competent authority for MiCA purposes. Founders must understand that MiCA and the national AML registration framework coexist during the transitional period, and the CSSF has issued guidance on how entities already registered as VASPs should transition to MiCA authorisation.

The Law of 10 August 1915 on commercial companies (Loi sur les sociétés commerciales), as amended, governs the corporate law aspects of any Luxembourg entity, including those operating in the crypto and blockchain space. This law sets out the rules for the Société Anonyme (SA), the Société à Responsabilité Limitée (SARL), and other vehicles used in practice.

In practice, it is important to consider that Luxembourg';s regulatory perimeter is broader than many founders initially assume. Providing custody of crypto assets, operating a trading platform, executing orders, or offering portfolio management in crypto assets all trigger licensing or registration obligations. Founders who structure their operations to avoid the appearance of regulated activity while substantively providing it face enforcement risk from the CSSF, which has demonstrated willingness to issue cease-and-desist orders and administrative fines.

---

The choice of corporate form is the first structural decision and has downstream consequences for governance, liability, fundraising, and regulatory treatment. Luxembourg offers several vehicles, and the optimal choice depends on the business model.

Société à Responsabilité Limitée (SARL) is the most common vehicle for early-stage crypto and blockchain companies. It requires a minimum share capital of EUR 12,000, fully paid up at incorporation. Governance is simpler than an SA: one or more managers replace the board structure, and shareholder decisions can be taken by written resolution. The SARL is suitable for founder-led businesses, technology companies, and entities that do not need to raise capital from a broad investor base. A non-obvious risk is that the SARL';s share transfer restrictions - shares cannot be freely transferred to third parties without shareholder approval - can complicate venture capital investment rounds if the articles are not carefully drafted from the outset.

Société Anonyme (SA) is the preferred vehicle for companies that anticipate institutional investment, plan a token issuance, or intend to apply for a full MiCA CASP licence. The SA requires a minimum share capital of EUR 30,000, at least 25% paid up at incorporation. It has a board of directors (or a supervisory board and management board under the two-tier model) and can issue different classes of shares, including shares with special economic or voting rights. For security token offerings under Luxembourg';s DLT securities law, the SA is typically the issuing entity.

Société en Commandite par Actions (SCA) is used in more sophisticated structures, particularly where a general partner entity controls the company while limited partners hold economic interests. This vehicle appears in crypto fund structures and in arrangements where founders want to retain control while bringing in external capital.

Specialised Investment Fund (SIF) and Reserved Alternative Investment Fund (RAIF) are fund vehicles rather than operating companies, but they are relevant for crypto asset managers and fund promoters. A RAIF can invest in crypto assets without prior CSSF product approval, provided it appoints an authorised alternative investment fund manager (AIFM). The RAIF structure has become popular for crypto funds targeting professional and well-informed investors.

A common mistake made by international founders is to incorporate the simplest available vehicle - often a SARL - without considering whether it will support the intended regulatory application. The CSSF';s fit-and-proper requirements for CASP authorisation under MiCA include governance standards that a minimal SARL structure may not satisfy without amendment. Retrofitting the corporate structure after a regulatory application has been submitted is costly and delays the process.

To receive a checklist for selecting the optimal corporate vehicle for a crypto or blockchain company in Luxembourg, send a request to info@vlolawfirm.com

---

The regulatory pathway for a crypto or blockchain company in Luxembourg has two distinct phases: the transitional VASP registration under national AML law, and the full MiCA CASP authorisation that replaces it for most activities.

VASP registration under national law is required for any entity providing virtual asset services in or from Luxembourg before MiCA authorisation is obtained. The CSSF';s registration process requires the entity to demonstrate: a registered office in Luxembourg, an adequate AML/CFT compliance framework, fit-and-proper management, and appropriate internal controls. The CSSF reviews the application and may request additional information. In practice, the registration process takes between three and six months from submission of a complete file. Incomplete applications significantly extend this timeline.

The services that trigger VASP registration include: exchange between virtual assets and fiat currencies, exchange between virtual assets, transfer of virtual assets, safekeeping and administration of virtual assets, and participation in and provision of financial services related to an issuer';s offer or sale of virtual assets. This list mirrors the FATF definition and the national AML law.

MiCA CASP authorisation is the primary regulatory framework going forward. Under MiCA, a CASP licence granted by the CSSF gives the holder a passport to provide crypto-asset services across the entire EU without needing separate authorisation in each member state. This passporting right is one of Luxembourg';s most commercially significant advantages as a CASP domicile.

MiCA distinguishes between different categories of crypto-asset services, each with specific capital requirements. Custody and administration of crypto assets on behalf of clients requires own funds of at least EUR 125,000. Operating a trading platform for crypto assets requires EUR 150,000. Providing advice on crypto assets or portfolio management requires EUR 50,000. These are minimum thresholds; the CSSF may require higher capital based on the scale and risk profile of the business.

The MiCA authorisation application requires, among other things: a programme of operations, a business plan, a description of governance arrangements, proof of initial capital, a description of internal control mechanisms, an AML/CFT policy, and information on the qualifying shareholders. The CSSF has 25 working days to assess whether the application is complete, and a further 40 working days to grant or refuse authorisation once the application is deemed complete. In practice, pre-application engagement with the CSSF - through informal meetings and written queries - is strongly advisable and can reduce the formal review period.

A non-obvious risk in the MiCA authorisation process is the substance requirement. The CSSF expects the applicant to have genuine operational substance in Luxembourg: a physical office, at least one executive director resident in or regularly present in Luxembourg, and key decision-making functions located in the Grand Duchy. Shell structures with a Luxembourg registered address but management and operations elsewhere will not satisfy the CSSF';s requirements. This is not merely a de jure requirement - the CSSF conducts on-site inspections and interviews management as part of the authorisation process.

Many underappreciate the cost of building adequate compliance infrastructure before applying. A robust AML/CFT framework for a CASP includes a compliance officer (who must be approved by the CSSF), transaction monitoring systems, customer due diligence procedures, and suspicious transaction reporting protocols. The cost of implementing this infrastructure, before any regulatory fees, typically runs into the low tens of thousands of EUR for a basic setup and can reach the mid-six figures for a complex operation.

---

The following scenarios illustrate how the legal and regulatory framework applies to different business models and founder profiles.

Scenario one: a technology company building a blockchain protocol

A team of developers incorporates a Luxembourg SARL to develop and deploy a decentralised protocol. The protocol itself does not involve the company providing custody, exchange, or other regulated services - it is open-source software. In this scenario, VASP registration and MiCA authorisation are not required for the development entity itself. The SARL is appropriate, and the main legal considerations are intellectual property ownership (ensuring the company holds the relevant IP rights through properly drafted employment and contractor agreements), token issuance (if the company plans to issue a utility token, MiCA';s white paper requirements apply even without a CASP licence), and corporate governance for future fundraising.

If the company later decides to operate a front-end interface that facilitates user interaction with the protocol in a way that constitutes providing a crypto-asset service, the regulatory position changes and a CASP authorisation becomes necessary. Founders in this scenario often underestimate how quickly the regulatory perimeter can expand as the product evolves.

Scenario two: a crypto exchange targeting EU retail clients

A founder group wants to operate a centralised exchange offering spot trading in crypto assets to retail clients across the EU. This is a core MiCA-regulated activity. The appropriate vehicle is an SA, given the governance requirements and the need to issue different share classes for institutional investors. The company must obtain a CASP authorisation from the CSSF before commencing operations. The minimum own funds requirement is EUR 150,000, but the CSSF will expect significantly more capital given the retail client base and the operational risks of running an exchange. The authorisation process, from initial CSSF engagement to licence grant, realistically takes 12 to 18 months for a well-prepared applicant.

The Luxembourg passport then allows the company to notify the CSSF and commence operations in other EU member states without separate national authorisations. This is the primary commercial rationale for choosing Luxembourg over a non-EU jurisdiction. Legal fees and compliance setup costs for this scenario typically start from the low six figures in EUR.

Scenario three: a crypto fund manager

An asset manager wants to launch a fund investing in a portfolio of crypto assets for professional investors. The manager incorporates a Luxembourg SA as the management company and applies to the CSSF for authorisation as an alternative investment fund manager (AIFM) under the Law of 12 July 2013 on alternative investment fund managers (Loi relative aux gestionnaires de fonds d';investissement alternatifs). The fund itself is structured as a RAIF, which does not require CSSF product approval and can be launched relatively quickly once the AIFM is authorised.

The AIFM authorisation process is separate from MiCA CASP authorisation, though the two frameworks overlap where the AIFM also provides individual portfolio management in crypto assets. The CSSF has clarified that an authorised AIFM managing a crypto fund does not automatically hold a MiCA CASP licence for portfolio management services provided outside the fund context. Founders in this scenario must map their full service offering against both frameworks.

To receive a checklist for the MiCA CASP authorisation process in Luxembourg, including documentation requirements and CSSF engagement strategy, send a request to info@vlolawfirm.com

---

Luxembourg';s reputation as a well-regulated financial centre depends on the CSSF enforcing substance and governance requirements rigorously. For crypto and blockchain companies, this means that the regulatory application is only the beginning of the compliance obligation.

Substance requirements in Luxembourg go beyond having a registered address. The CSSF expects the following for a CASP or AIFM:

• At least two approved senior managers who are genuinely involved in day-to-day management and who spend a meaningful portion of their working time in Luxembourg.
• A physical office with adequate infrastructure, not a shared desk in a serviced office used by dozens of other entities.
• Key functions - compliance, risk management, and internal audit - either performed in Luxembourg or, where outsourced, subject to effective oversight by Luxembourg-based management.
• Board meetings held in Luxembourg at a frequency appropriate to the complexity of the business.

The CSSF';s substance requirements are not static. As the business grows, the regulator expects the Luxembourg operation to grow proportionally. A company that obtains a CASP licence with a lean Luxembourg team and then shifts all substantive operations to another jurisdiction risks having its licence suspended or revoked.

Governance requirements under MiCA require the management body of a CASP to have collective knowledge, skills, and experience adequate to understand the CASP';s activities and the principal risks it faces. This includes understanding of crypto-asset markets, DLT technology, cybersecurity risks, and financial crime typologies specific to virtual assets. The CSSF assesses each member of the management body individually through a fit-and-proper process. Non-executive directors or supervisory board members are also subject to this assessment.

AML/CFT compliance is the area where the CSSF has been most active in enforcement against crypto entities. The Law of 12 November 2004, as amended, requires VASPs and CASPs to implement a full AML/CFT programme including: customer due diligence (CDD) and enhanced due diligence (EDD) for higher-risk clients, transaction monitoring, suspicious transaction reporting to the Cellule de Renseignement Financier (CRF), record-keeping for at least five years, and regular training of staff.

A common mistake is to implement a generic AML/CFT framework designed for traditional financial institutions without adapting it to the specific risks of crypto assets. The CSSF expects crypto-specific risk assessments that address blockchain analytics, the risks of anonymity-enhancing technologies, and the geographic risks associated with cross-border crypto flows. Firms that rely on off-the-shelf compliance software without customising it to their specific client base and transaction patterns have faced CSSF criticism during inspections.

The Travel Rule - the requirement under Regulation (EU) 2023/1113 on information accompanying transfers of funds and certain crypto-assets to include originator and beneficiary information in crypto-asset transfers - applies to CASPs in Luxembourg. Implementing Travel Rule compliance requires technical infrastructure and counterparty agreements with other VASPs and CASPs globally. Many underappreciate the operational complexity of Travel Rule compliance, particularly for transfers to or from unhosted wallets.

---

Luxembourg is not the optimal jurisdiction for every crypto or blockchain business. Understanding when an alternative is more appropriate is as important as understanding Luxembourg';s strengths.

When Luxembourg is the right choice:

• The business model requires EU passporting for regulated crypto-asset services.
• The company plans to issue security tokens or tokenised financial instruments and needs a jurisdiction with a statutory DLT securities framework.
• The founders are building a crypto fund targeting EU professional investors and want an established AIFM framework.
• The business has sufficient scale to justify the cost of Luxembourg substance: a realistic minimum annual operating cost for a compliant Luxembourg CASP is in the low to mid six figures in EUR, excluding regulatory fees.

When Luxembourg may not be the right choice:

• The business is at an early stage and cannot yet justify the cost of Luxembourg substance and compliance infrastructure. In this case, a simpler EU jurisdiction with lower operating costs may be more appropriate for the initial phase, with a migration to Luxembourg planned once the business reaches sufficient scale.
• The business model does not require EU passporting and the founders are comfortable operating from a non-EU jurisdiction. Singapore, the UAE (particularly the DIFC and ADGM frameworks), and other jurisdictions offer competitive regulatory frameworks for crypto businesses that do not need EU market access.
• The business is purely a technology development entity with no regulated service component. In this case, the regulatory overhead of Luxembourg may not be justified, and a simpler corporate structure in a lower-cost jurisdiction may be more efficient.

The business economics of the decision deserve careful analysis. A Luxembourg CASP structure involves: incorporation costs (typically in the low thousands of EUR for a standard SA or SARL), regulatory application fees (set by CSSF regulation and varying by licence type), ongoing annual supervisory fees, compliance infrastructure costs, substance costs (office, staff, management time), and legal and audit fees. For a well-capitalised business targeting the EU market, these costs are justified by the commercial value of the EU passport. For a startup with limited capital, they may consume resources that would be better deployed in product development.

A non-obvious risk of choosing Luxembourg prematurely is the CSSF';s expectation of ongoing compliance investment. Once a company holds a CASP licence, the CSSF expects it to maintain and improve its compliance framework continuously. Firms that obtain a licence and then reduce their compliance investment face supervisory action. The cost of non-compliance - including fines, licence suspension, and reputational damage - significantly exceeds the cost of maintaining adequate compliance from the outset.

The risk of inaction also deserves mention. Under MiCA';s transitional provisions, entities that were providing crypto-asset services before MiCA';s full application date and that registered as VASPs under national law have a transitional period to obtain full MiCA authorisation. Entities that fail to apply for MiCA authorisation within the transitional period must cease regulated activities. The CSSF has been clear that it will not extend the transitional period for entities that have not made genuine progress toward MiCA compliance.

We can help build a strategy for your crypto or blockchain company setup in Luxembourg, including regulatory pathway analysis and corporate structuring. Contact info@vlolawfirm.com

---

What is the most significant practical risk for a crypto company applying for a CASP licence in Luxembourg?

The most significant practical risk is underestimating the substance and governance requirements that the CSSF enforces in practice. Many founders assume that incorporating a Luxembourg entity and appointing a local director is sufficient. The CSSF expects genuine operational presence: management who are actively engaged in Luxembourg, a functioning compliance framework, and key decisions taken in the Grand Duchy. Applications that cannot demonstrate real substance are refused or, worse, granted and then subjected to intensive supervisory scrutiny that reveals the deficiency. Building adequate substance before applying - rather than after - is the more cost-effective approach, even though it requires upfront investment.

How long does the MiCA CASP authorisation process take in Luxembourg, and what does it cost?

From initial engagement with the CSSF to licence grant, a well-prepared applicant should budget 12 to 18 months. The formal statutory timeline under MiCA is 25 working days for completeness assessment and 40 working days for the substantive review, but pre-application engagement, document preparation, and CSSF queries in practice extend the overall process significantly. Total costs - including legal fees for application preparation, compliance infrastructure setup, and CSSF supervisory fees - typically start from the low six figures in EUR for a straightforward application and can reach the mid-six figures for a complex business model. Founders who attempt to prepare the application without specialist legal support consistently underestimate the documentation burden and produce incomplete files that restart the CSSF';s review clock.

Should a crypto startup choose a Luxembourg SA or SARL, and can the structure be changed later?

The choice depends primarily on the intended regulatory pathway and fundraising plans. A SARL is simpler and cheaper to incorporate and maintain, and it is appropriate for technology companies and early-stage businesses that do not yet need institutional investment or a full CASP licence. An SA is necessary for companies that plan to issue different share classes, raise institutional capital, or apply for a CASP licence with governance requirements that a SARL structure cannot easily satisfy. Conversion from a SARL to an SA is legally possible under Luxembourg company law, but it requires a notarial deed, shareholder approval, and amendment of the articles of association. The conversion process takes several weeks and involves notarial and registration costs. More importantly, if the conversion is needed during a regulatory application, it can delay the process. Founders who anticipate needing an SA within two to three years are generally better served by incorporating as an SA from the outset.

---

Luxembourg offers a legally sophisticated, EU-passportable, and operationally viable jurisdiction for crypto and blockchain companies that have the scale and commitment to meet its substance and compliance requirements. The combination of MiCA CASP passporting, a statutory DLT securities framework, and an experienced regulator in the CSSF makes it one of the most commercially valuable jurisdictions in Europe for regulated crypto businesses. The key to a successful setup is matching the corporate vehicle and regulatory pathway to the actual business model, building genuine substance from the outset, and engaging with the CSSF proactively rather than reactively.

Our law firm VLO Law Firms has experience supporting clients in Luxembourg on crypto, blockchain, and financial regulatory matters. We can assist with corporate structuring, VASP registration, MiCA CASP authorisation applications, AML/CFT compliance framework design, and ongoing regulatory advisory. To receive a consultation or to request a checklist for your specific setup scenario, contact: info@vlolawfirm.com