#
Luxembourg's MiCA transitional period ended 1 July 2026, formally closing the national VASP-registration pathway (Article 7-1(2) of the amended 2004 AML law) that had previously governed crypto firms via the Article 143(3) grandfathering clause. The CSSF has continued issuing full CASP authorisations, confirmed for Ripple, B2C2 and Coinbase, while industry sources describe substantial EU-wide market attrition among firms that did not secure authorisation before the cutover.
The legal mechanics of the transition are anchored in MiCA's Article 143(3) grandfathering clause, which permitted firms providing crypto-asset services under Luxembourg's prior national law before 30 December 2024 to continue operating until 1 July 2026 or until a MiCA authorisation decision was issued -- whichever came first. Firms that had been registered under the pre-MiCA virtual-asset-service-provider pathway, specifically Article 7-1(2) of Luxembourg's amended 2004 anti-money-laundering law, have now been largely superseded by the MiCA CASP track, though the precise operational status of any registrants who did not transition is not yet confirmed against the CSSF's public register. Industry commentary referenced in this cycle describes significant market attrition accompanying the cutover, with only a few hundred firms securing full CASP authorisation across the EU out of an estimated several thousand that had been operating under varied national regimes; this figure is treated as a non-binding, directional market observation rather than a regulatory finding, since it is sourced to industry commentary rather than a CSSF or ESMA statistical release.
Outlook
The licensing module is likely to remain amber in the near term less because of ambiguity in the rules themselves -- MiCA's CASP authorisation requirement is now settled EU law with a clear national implementation via the CSSF -- and more because of the transitional friction the cutover has generated: continuing enforcement action against unauthorised firms, uncertainty about the fate of former national VASP registrants, and the broader EU-wide consolidation of the crypto-service-provider population. Subsequent cycles should confirm whether the CSSF's public register shows any lapsed or withdrawn Article 7-1(2) registrations, and should track whether ESMA's supervisory-convergence statements evolve into more concrete enforcement disclosures specific to Luxembourg.
Crypto Licensing
Luxembourg's crypto-licensing regime reached a structural closure point this cycle with the end of the MiCA VASP-to-CASP grandfathering transition. Under Regulation (EU) 2023/1114 (MiCA), crypto-asset service providers operating in Luxembourg must hold CASP authorisation from the CSSF; the eighteen-month transitional window that allowed previously CSSF-registered virtual asset service providers to continue operating under their existing registration closed on 1 July 2026. This is a Confirmed finding, sourced directly from the CSSF's own 1 July 2026 public statement, and it is binding and in force as of this cycle.
The mechanics of the transition are themselves instructive. VASPs that had registered with the CSSF before 30 December 2024 -- the date the bulk of MiCAR's remaining provisions, including the CASP authorisation requirement, became applicable -- were permitted a grace period running until 1 July 2026 or an earlier refusal of CASP authorisation, whichever came first. That grace period has now expired for any provider that had not secured full CASP authorisation. The practical consequence is that any provider still operating in Luxembourg on the strength of the old VASP registration alone, without having converted to CASP status, is no longer permitted to offer crypto-asset services -- a hard compliance cliff rather than a gradual wind-down. This finding on the transitional mechanics itself carries Confirmed confidence but rests on a tier-3 legal-commentary source rather than a directly retrieved primary CSSF circular describing the transitional regime's original terms, a modest sourcing gap worth noting.
The regime's traffic-light assessment is green: the framework is settled, fully in force, and the transition closed cleanly with no evidence of disorderly wind-down or contested enforcement this cycle. The primary framework is Regulation (EU) 2023/1114 (MiCA) and the supervisory authority is the CSSF. No LU-specific enforcement action against providers that failed to convert in time has been identified this cycle, and none is asserted in the absence of evidence.
Outlook
The item to watch is whether any residual population of providers that were mid-process on CASP applications as of the 1 July 2026 cutoff either complete authorisation or face enforcement for continuing to operate without it. Given Luxembourg's emerging profile as a concentration point for CASP authorisation activity, any enforcement pattern here would be a meaningful signal for the maturity of CSSF's post-transition supervisory posture.
2 earlier distinct update(s)
Crypto Licensing
The defining event of this cycle is the expiry, on 1 July 2026, of the eighteen-month MiCA transitional window available to entities that had registered as virtual-asset service providers with the CSSF before 30 December 2024. The CSSF has confirmed that, as of that date, entities providing crypto-asset services in Luxembourg without CASP authorisation under MiCA are operating without a valid legal basis; the VASP-registration grandfathering window has closed entirely. This is a Confirmed, T1-sourced finding directly from the CSSF's own publication, and it represents the dominant structural tightening in Luxembourg's crypto-licensing regime this cycle: a permissive registration status that had allowed legacy VASPs to operate under lighter AML-registration obligations has been converted into a binding authorisation-or-cease requirement.
The CSSF has also confirmed the precise scope of the one available exception. Third-country crypto-asset service providers may serve Luxembourg or EU customers under the reverse-solicitation exemption, but this is available only where the customer initiates contact; active solicitation by the third-country provider does not qualify, and engaging in it may result in a service prohibition. This is a materially important operational boundary for any third-country provider assessing whether it can continue Luxembourg-facing activity without full CASP authorisation, and it leaves comparatively little room for providers to rely on the exemption as a substitute for authorisation where any form of active marketing toward Luxembourg or EU customers is occurring.
Corroborating evidence indicates the CSSF's authorisation-processing capacity remained active through and beyond the transition deadline rather than freezing around it. The regulator granted a preliminary MiCA CASP authorisation to an OTC liquidity provider on 13 May 2026, ahead of the deadline, and a full CASP authorisation to a major payments-token issuer on 6 July 2026, shortly after the deadline passed. Both of these developments are sourced at T3 confidence, corroborating rather than establishing the underlying CSSF authorisation throughput, and support a Probable-confidence reading that the CSSF maintained active supervisory processing capacity spanning the transition period rather than allowing authorisation backlogs to accumulate at the deadline itself.
The traffic-light position for this module is amber, reflecting a live enforcement and compliance-status uncertainty window: any Luxembourg-facing crypto-asset provider not yet fully CASP-authorised now sits in an ambiguous position, whether because it has an authorisation application still pending, because it is relying on the reverse-solicitation exemption, or because it has simply failed to convert and has not yet drawn supervisory attention. This is a genuinely tightening trajectory rather than a stable one.
Outlook
The most significant open question for the coming cycle is the scale of the non-converted legacy VASP population in Luxembourg: how many entities that were previously registered as VASPs failed to obtain CASP authorisation before the 1 July 2026 deadline, and what supervisory or enforcement posture the CSSF adopts toward that population. This was not established this cycle and constitutes a genuine coverage gap rather than a confirmed absence of non-compliant firms. Continued monitoring of CSSF authorisation-grant announcements will also help establish whether the authorisation throughput observed through mid-2026 continues at a similar pace now that the transition deadline has passed, which would further support a reading of orderly market transition.
Crypto Licensing
Luxembourg's crypto-licensing regime completed its transition from a transitional VASP model to a fully operative MiCA CASP perimeter as of 1 July 2026, when the 18-month grandfathering period for CSSF-registered virtual-asset service providers ended (high confidence; primary CSSF source). Providers that have not been granted, or have been refused, CASP authorisation under Regulation (EU) 2023/1114 may no longer offer crypto-asset services in the European Union. VASPs registered with the CSSF as of 30 December 2024 benefited from an 18-month transitional period permitting continued operation until 1 July 2026 or the grant/refusal of CASP authorisation, whichever came first (high confidence; tier-3 law-firm tracker). This closure narrows materially the population of unsupervised or transitionally-supervised crypto operators able to serve Luxembourg and the wider EU market, and it is the most consequential crypto-licensing development for Luxembourg this cycle.
Outlook
Watch for CSSF disclosure of how many previously-registered VASPs were granted, versus refused, CASP authorisation, and for any enforcement action against providers that continued operating past 1 July 2026 without a resolved authorisation status.
Sources and findings (5)
- T1 · ESMACrypto-asset service providers (CASPs) in Luxembourg/EU — CSSF-issued CASP authorisation under MiCA to provide crypto-asset services; unauthorised firms lost the ability to legally operate in the EU following the end of national transitional periods on 1 July 2026.retrieved M5bindingin forcenew
- T4 · CoinDeskCSSF — Full MiCA CASP authorisations to firms including Ripple, B2C2, and Coinbase, enabling EEA-wide passporting of crypto-asset services.retrieved M4bindingin forcenew
- T4 · The Block (press release)Virtual asset service providers (pre-MiCA) — Article 7-1(2) of the amended law of 12 November 2004 on AML/CFT as the pre-MiCA VASP registration pathway, now largely superseded by MiCA CASP authorisation.retrieved M3bindingin forcenew
- T1 · ESMAMiCA Article 143(3) grandfathering clause — Entities providing crypto-asset services under Luxembourg's pre-existing national law before 30 December 2024 to continue operating until 1 July 2026 or until a MiCA authorisation decision was issued.retrieved M3bindingin forcenew
- T4 · The BlockPreviously nationally-registered crypto firms (EU-wide) — The ability to serve EU clients following the 1 July 2026 end of MiCA transitional periods; only a few hundred firms EU-wide secured full CASP authorisation out of thousands under prior national regimes.retrieved M3non-bindingnew