Luxembourg has taken a significant step in combating money laundering by officially designating cryptocurrency firms, particularly Virtual Asset Service Providers (VASPs), as “high-risk” entities in its 2025 National Risk Assessment (NRA). This move comes as a response to the inherent susceptibility of VASPs to misuse, as outlined in the report.
The report highlights several risk factors that contribute to the high-risk nature of VASPs. These factors include the high volume of transactions processed by VASPs, the global reach of their clientele, the use of complex legal structures, and the decentralized, internet-based nature of their operations. These characteristics make VASPs attractive targets for money laundering operations involving proceeds from cybercrime, fraud, tax offenses, and corruption.
One key vulnerability identified in the report is the ease with which digital assets can be transferred across jurisdictions with minimal regulatory oversight. This lack of oversight makes it challenging to supervise VASPs adequately and identify illicit financial flows. The report also cites cases where VASPs in Luxembourg were registered without a sufficient understanding or application of anti-money laundering (AML) rules.
Regulatory authorities, including the Commission de Surveillance du Secteur Financier (CSSF), have taken steps to enhance oversight efforts in response to these vulnerabilities. However, the report warns of capacity constraints and the need for improved supervisory tools tailored to the rapidly evolving crypto industry.
Luxembourg’s decision to classify crypto firms as high-risk is expected to influence the country’s policy priorities and resource allocation in the fight against financial crime. It may also impact how Luxembourg implements the upcoming EU-level Markets in Crypto Assets (MiCA) regulation later in 2025.
While the report does not accuse specific firms of wrongdoing, it serves as a warning to both domestic and foreign VASPs operating in or through Luxembourg. Enhanced monitoring, stricter compliance checks, and targeted guidance are likely to follow as authorities respond to the heightened risk profile of the sector.
In parallel with these efforts, Luxembourg is taking a cautious approach to the implementation of the MiCA regulation. The country has not yet published official figures on the number of Crypto-Asset Service Providers (CASPs) authorized under MiCA. Instead, Luxembourg is utilizing the 18-month transitional period provided by MiCA to gradually adapt to the regulation’s new compliance standards.
Despite the absence of a published registry of authorized CASPs, key developments indicate regulatory progress. Major exchanges such as Bitstamp have secured their CASP licenses under MiCA from the CSSF. Additionally, banking giant Standard Chartered has announced plans to establish a crypto and digital asset custody hub in Luxembourg, citing MiCA’s harmonized legal framework as a strategic advantage.
Overall, Luxembourg’s efforts to combat money laundering in the crypto sector and its cautious approach to MiCA implementation demonstrate a commitment to strengthening its anti-money laundering framework and addressing regulatory gaps in the rapidly evolving crypto industry.