Luxembourg tightens crypto reporting rules for CASPs
Reporting covers portfolio management, custody, exchanges, crypto transactions, and client order execution, with penalties up to €250,000 for non-compliance.
Luxembourg introduced draft Law 8592 outlining registration, due diligence, and reporting duties for crypto-asset service providers. Mandatory reporting starts on 1 January 2026, covering crypto-assets, life insurance income, cross-border rulings, and expanded automatic tax data exchange.
The law applies to a broad range of crypto-asset activities, including portfolio management, custody, and exchange platforms. It also covers crypto-to-fund or crypto-to-crypto transactions and client order execution.
Luxembourg’s definition of crypto-assets aligns with EU MiCAR rules but includes all assets used for payment or investment purposes. Tax authorities will share reported data with the user’s country of residence by 30 September of the following year, starting with 2026.
CASPs must register with Luxembourg tax authorities by 30 June each year for reporting the previous year’s data. MiCAR-authorised operators are exempt from active registration. Penalties range from €5,000 for missed registrations to €250,000 for failing due diligence or reporting obligations.
The law also requires CASPs to verify user information through reasonable due-diligence procedures.
Law 8592 further updates rules on cross-border arrangements, online platform reporting, the Common Reporting Standard, and country-by-country reporting. DAC6 amendments now follow EU Court rulings, keeping lawyers’ client notifications while removing wider intermediary duties.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
