Anticipating MiCA in Luxembourg: Major changes ahead for crypto players

At a glance

For those keeping track of crypto developments, it will come as no surprise that a significant new law in Europe, the Markets in Crypto Assets (MiCA) Regulation, is just around the corner and will start to apply from 30 December 2024.¹

For more about MiCA and its main implications for crypto asset issuers and crypto asset service providers (CASPs), please refer to our previous article on the topic. 

However, it is less well known that MiCA includes an optional transitional regime to avoid disruption to existing market participants. This allows Member States to grant a compliance “grace period” to already licensed crypto actors under national rules.

Therefore, entities providing crypto services in Europe will need to start their MiCA journey by understanding if and to what extent the Member State where they are registered has decided to benefit from this transitional regime.

What does this mean in Luxembourg context?

In May 2024, a bill of Law n° 8387 (“Draft Law”) came before the Luxembourg Parliament, which defined the following to implement MiCA into national law:

• The Commission de Surveillance du Secteur Financier (CSSF) as a competent authority in charge of supervising MiCA compliance;
• The Luxembourg transitional regime; and
• The fines for MiCA compliance breaches.

Regarding the transitional regime, virtual asset service providers (VASPs) registered on 30 December 2024 will likely benefit from an 18-month transitional period,² allowing them to provide crypto-related services in Luxembourg until 1 July 2026.

By opting for MiCA’s maximum transitional period, Luxembourg has seemingly reaffirmed its position as an innovation-friendly jurisdiction that caters to the needs of its diverse market players. In comparison, Germany is only likely to allow 12 months and the Netherlands only six months for existing entities to transition to MiCA.

This being said, the CSSF only supervises VASPs in Luxembourg for anti-money laundering and counter-terrorism financing purposes. Compliance gap for such entities between where they stand now and MiCA requirements will be significant, especially for those yet unregulated firms.

For this reason, we strongly encourage VASPs to take swift action to implement MiCA requirements, regardless of the additional compliance time.

VASPs that decide to wait will also face commercial consequences and lose their competitive edge by not obtaining an EU passport. Providing crypto services across the EU market will only be possible under the fully fledged MiCA license, while entities remaining within the VASP regime will be restrained to the Luxembourg market.

Existing VASPs that do not comply with MiCA by July 2026, as well as newly licensed or notified CASPs under MiCA that fail to comply on an ongoing basis, will face serious fines under the Draft Law of up to EUR5 million or 12.5% of the company’s total annual turnover.³

Evolution of the Luxembourg market

Increased interest by financial firms to engage in the crypto space 

MiCA will provide much-needed legal certainty for all stakeholders in the crypto asset value chain, including crypto asset issuers, CASPs seeking to meet their clients’ demands, and investors wishing to use crypto assets to diversify their portfolios, for arbitrage purposes or as an inflation hedge.

This legal certainty and the latest success stories involving cryptocurrency exchange-traded funds (ETFs) have recently catalyzed business development in Luxembourg. Notably, financial institutions have started offering crypto asset services, such as custody services or fund management services for portfolios investing in decentralized cryptocurrencies.

It certainly helps that already authorized financial institutions, such as banks, central securities depositories (CSDs) and investment firms, do not need additional authorization under MiCA to provide equivalent services they are already authorized for, just now in relation to this new asset class.

For example, a bank in Luxembourg that provides custody services can extend this service to crypto assets by notifying the CSSF of its intention. With this in mind, the CSSF recently asked financial firms interested in becoming CASPs under MiCA to complete a dedicated questionnaire.

Small players are preparing to become regulated entities
 

Currently unregulated firms in Luxembourg (VASPs such as crypto exchanges and specialized crypto custodians) may find it difficult to convert the VASP registration into the CASP license. The substantial regulatory burden and related compliance costs present an unfamiliar challenge for these firms.

Some of these VASPs already started positioning themselves by partnering with financial institutions that sometimes lack the expertise and operational know-how when it comes to crypto assets. Others may contemplate acquisition by financial groups that wish to expand their crypto offerings, mostly driven by client demand. The remaining will have no choice but to apply for license under MiCA.

Besides MiCA, CASPs should not underestimate impact of another critical law going live beginning of 2025: the Digital Operational Resilience Act (DORA). DORA explicitly captures all CASPs within its perimeter and imposes stringent requirements for CASPs in terms of ICT risk management, ICT third party controls and oversight, incident reporting and operational resilience.

Under DORA, CASPs that are part of financial groups will to some extent benefit from reliance on group-level ICT security policies and controls. Nevertheless, ICT specific risks pertaining to the underpinning technology of crypto asset (i.e., blockchain) will have to be considered for the purpose of DORA implementation. This will call for effective coordination between financial institutions and CASPs to which they might delegate certain crypto activities. 

How Deloitte can help

If you are a Luxembourg VASP or intend to become a CASP under MiCA, consider starting your journey with Deloitte.

With the MiCA deadline fast approaching, entities active in the crypto space must strategically adapt to ensure their operations are compliant.

Deloitte’s specialists and dedicated services can help you tackle not only the compliance challenges but also the opportunities arising from ambitious new laws.

Deloitte can support you in critical areas, such as:

• Review your corporate or product strategy regarding crypto asset services;
• Design your operating model and control framework;
• Perform regulatory and operational gap analysis;
• Select crypto asset service or technology providers;
• Support with preparing and filing the license application; and
• Certify services regarding stablecoins.

Deloitte’s Regulatory Watch team closely follows crypto-related legislative developments and can help you stay ahead of the regulatory curve.

¹ Since 30 June 2024, MiCA has already started to apply to issuers of asset reference tokens (ARTs) and e-money tokens (EMTs).

² As the Draft Law is still not finalized, the transition period is subject to change.

³ For market abuse practices, fines can reach EUR15 million or 15% of the company’s total annual turnover.