Luxembourg Crypto Firms Face 18-Month MiCAR Deadline Expiry: 2 July 2026 Compliance Shifts

For regulatory lawyers and compliance officers in Luxembourg, the expiration of the MiCAR transitional period is not merely a calendar event—it is a sudden compliance cliff. Clients that previously relied on the AML-law VASP registration now face unbuffered legal exposure if they continue crypto services without a full CASP licence. The CSSF's updated FAQ and ESMA's public statement provide a roadmap for what the competent authority will now enforce, making it essential for legal advisors to understand the scope of Article 60(5) obligations and the risks of non-compliance.

The 18-month transitional period granted under Article 143(3) of the EU Markets in Crypto-Assets Regulation (MiCAR) expired on 1 July 2026, marking a definitive regulatory watershed for crypto-asset service providers (CASPs) in Luxembourg and across the European Union. As of that date, any entity providing MiCAR-regulated crypto-asset services in Luxembourg without a valid MiCAR CASP authorisation is operating outside the law. For Luxembourg, a key financial hub that previously relied on its virtual asset service provider (VASP) registration regime under the 2004 AML Law, this shift is profound. The VASP registration, which focused primarily on anti-money laundering and counter-terrorist financing obligations, is no longer sufficient to conduct crypto-asset services legally. Market participants that have not obtained full MiCAR authorisation now face immediate enforcement risk, including potential orders to cease operations.

“

In Luxembourg, the Commission de Surveillance du Secteur Financier (CSSF) had signalled the approaching deadline through updated guidance.

The expiry of the transitional period was long anticipated. MiCAR became fully applicable on 30 December 2024, and the transitional provision gave existing national-regime entities 18 months to prepare. In Luxembourg, the Commission de Surveillance du Secteur Financier (CSSF) had signalled the approaching deadline through updated guidance. A March 2026 client alert by K&L Gates highlighted the CSSF's revised FAQ on crypto assets in investment funds, notably the new obligation for investment fund managers (IFMs) to assess their crypto-related activities against Article 60(5) of MiCAR. That provision addresses the interaction between investment funds and crypto-asset services, and its importance has grown now that the transitional umbrella has been withdrawn. The CSSF's expectations are clear: IFMs must determine whether their activities trigger MiCAR authorisation requirements and act accordingly.

The European Securities and Markets Authority (ESMA) reinforced the transition's significance with a public statement on 23 June 2026. ESMA set out expectations for unauthorised CASPs, urging them to either apply for authorisation or implement an orderly wind-down of their crypto-asset services. The statement also reminded competent national authorities of their duty to enforce compliance, signalling a coordinated EU-level stance against any post-deadline regulatory arbitrage. For Luxembourg-domiciled firms, this means CSSF will be scrutinising the market closely, and any unauthorised activity will likely attract swift supervisory attention. The reputational and financial consequences of non-compliance can be severe, potentially including fines, business restrictions, or criminal liability for egregious cases.