Fintech in Luxembourg: the fund industry decides what gets built

The Commission de Surveillance du Secteur Financier supervises the Luxembourg financial sector, and it runs an Innovation Hub as the point of contact for firms with a business model the existing categories do not obviously fit. The Hub gives guidance and talks to firms before an application, which matters in a country where most fintech activity needs a license of some kind.

On crypto the CSSF has moved further than most EU supervisors, and in a specific direction. Its guidance now permits a UCITS indirect exposure to crypto assets of up to 10 percent of net asset value, through transferable securities that embed no derivative, which in practice means exchange-traded products. Direct ownership of a crypto asset by a UCITS stays prohibited, on investor protection grounds. That is a notable change from the earlier position, which allowed crypto exposure only in alternative funds not marketed to retail investors. Where a fund may invest in crypto assets, the prospectus has to say so, which puts the question in front of the CSSF before the fund launches instead of afterward.

Luxembourg's regulatory history with crypto firms is longer than that guidance. In 2016 the CSSF granted Bitstamp a payment institution license under the EU payment services rules, the first such license for a crypto exchange in the EU, after an application process of nearly two years. That license passported across the member states, which is the mechanism Luxembourg has used ever since.

Luxembourg legislated for distributed ledgers in four steps, each solving the problem the previous one left open. The first law, in 2019, amended the 2001 law on the circulation of securities so that securities accounts could be held, registered and transferred using a distributed ledger. That made a ledger a lawful place to record a transfer, and it left the issuance itself in the old world.

The second law, of 22 January 2021, closed that gap: it allowed dematerialized securities to be issued on a ledger, introduced the issuance account as a legal concept, and widened the account keeper role so that any EU credit institution or investment firm could act as account keeper for unlisted debt securities, subject to IT control and security requirements. The third law brought the result into line with the wider EU framework, confirming that securities issued on a ledger meet the definition of financial instruments, bringing them under the EU DLT Pilot Regime, and making ledger-based securities usable as financial collateral, which is what a repo desk needs before it will touch them.

The fourth law, voted on 19 December 2024, did two things. It let banks and investment firms act as central account keeper for non-listed capital securities, extending to equity what the second law had done for debt. And it created the control agent, a role with no equivalent elsewhere, which Elvinger Hoss describes as an alternative to the central account keeper.

The control agent holds the issuance account of a tokenized security, oversees the custody chain behind it, and reconciles the ledger-based issuance account with the securities accounts. Banks, investment firms and settlement organizations may take the role after notifying the CSSF at least two months in advance, with information showing they have the resources and the expertise for it.

What the role removes is the two-tier holding chain. Under the older model an issuance needed a central account keeper above and secondary account keepers below, a structure built for a world where no single record could be trusted by everyone. On a ledger that record exists, so the legislator let the structure collapse into one agent who checks it. For a fund that wants its share register on a ledger, that is the difference between an issuance that needs two intermediaries and one that needs a single controlling party. Finance Loop keeps the mechanics of an issuance at tokenization in Luxembourg.

A tokenized fund needs two things that have nothing to do with tokens: a recognized legal wrapper that institutional investors may hold, and service providers who can administer it. Luxembourg supplies both. A UCITS may be distributed to retail investors across the EU on one authorization, and an alternative fund under the AIFM framework may be marketed to professional investors the same way. Put the share register on a ledger and the wrapper does not change, which is the entire appeal: the investor buys a fund share with the protections attached to that form, and the register happens to be a ledger.

The service providers are the harder part, and the reason tokenized funds cluster here and not in jurisdictions with friendlier rhetoric. A fund needs an administrator who can calculate a net asset value, a depositary who will take responsibility for the assets, and a transfer agent who maintains the register. The ones in Luxembourg have been asked to do this on a ledger often enough to have built the processes. Finance Loop covers the product at tokenized funds and tokenized money market funds.

The Luxembourg House of Financial Technology describes itself as the national fintech platform, bringing together innovators, financial institutions and public authorities to support and accelerate fintech innovation in Luxembourg. It is a public-private foundation, and for a firm arriving from outside it is the practical first stop, because it knows which bank is already working on the problem.

Luxembourg Blockchain Week is the annual gathering on the ledger side, and the searches around it are the clearest sign that the topic has an audience beyond the law firms. For a Frankfurt firm the relevant question is usually the opposite direction: which Luxembourg structure holds the asset that the German desk is trading, which comes up at Finance Loop events on digital assets.

MiCA applies in Luxembourg as in every member state, and a crypto-asset service provider authorized by the CSSF may passport its services across the EU on that single authorization. Luxembourg's argument for being the place to apply is not the rulebook, which is identical everywhere, but the supervisor's familiarity with cross-border financial services and the presence of the banks a crypto firm needs as counterparties.

Stablecoin issuance under MiCA is a separate authorization, for e-money tokens or asset-referenced tokens, and it sits with a credit institution or an electronic money institution. A firm weighing Luxembourg against Germany for either is comparing supervisory practice, since the law is identical. Finance Loop covers the regime at MiCA in Europe and the authorization at the CASP license, with the German route at MiCA in Germany.

The two centers are 200 kilometers apart and divide the work instead of competing for it. Frankfurt has the trading, the market infrastructure and the European Central Bank; Luxembourg has the fund domicile and the administration. A German asset manager launching a digital asset product commonly domiciles the fund in Luxembourg and trades it in Frankfurt, which means the people doing the work are in both places and travel between them.

Finance Loop's network runs along that line. The Frankfurt financial center page covers the German side, and Luxembourg professionals turn up at Frankfurt events on tokenized funds because that is where their counterparties are.

Because the customers are there. Luxembourg is Europe's largest fund domicile and a banking center with a cross-border focus, so a firm selling software or services to fund administrators, depositaries and asset managers finds its entire market inside one city. Add an EU passport for any license granted here, a supervisor with an Innovation Hub for unusual business models, and four blockchain laws written specifically to make ledger-based securities work, and the case assembles itself. The weakness is the same fact in reverse: the domestic consumer market is too small to build a retail product on.

Indirectly, up to 10 percent of net asset value, through transferable securities that do not embed a derivative, which in practice means exchange-traded products on crypto assets. A UCITS may not own a crypto asset directly. Where a fund intends to take such exposure, the prospectus has to disclose it, so the CSSF sees the intention before the launch. For an alternative fund marketed to retail investors, the CSSF expects internal control functions equipped for the volatility, the liquidity and the technology risk.

It is the CSSF's contact point for firms whose business model does not map cleanly onto an existing license category. It gives guidance and holds a dialogue with the firm before an application goes in, which saves both sides the cost of an application built on the wrong category. It does not grant anything and it does not pre-approve a model; the license process runs as normal afterward.

Neither is better in law, because MiCA is the same regulation in both and an authorization from either passports across the EU. The differences are practical: which supervisor's processing times and expectations suit the applicant, where the firm's staff and counterparties already are, and which banks will open an account. A firm whose business is fund-related usually finds Luxembourg simpler because the clients are there; a firm whose business is trading usually finds Frankfurt simpler for the same reason. Finance Loop covers the German route at MiCA in Germany.