Tax Summary:

1. Personal income tax – from 0% to 42%
2. Corporate income tax – 17% and municipal business tax 6.75%  – 10.5%

What law/s governs VASP activities?

1. The Law of 12 November 2004 on the fight against money laundering and terrorist financing

What activities are included in VASP services?

1. Exchange between VA and fiat currencies, including the service of exchange between virtual currencies and fiat currencies.
2. Exchange between one or more forms of VA.
3. Transfer of VA.
4. Safekeeping or administration of VA or instruments enabling control over VA. including custodian wallet service.
5. Participation in and provision of financial services related to an issuer’s offer or sale of VA.

Who is the VASP regulator?

1. La Commission de Surveillance du Secteur Financier (CSSF)

What is the procedure for registering a VASP for a local company?

Entities established in Luxembourg or providing services in Luxembourg cannot offer virtual asset services without registration with CSSF, as provided for in Article 7-1(1) of the Law of November 12, 2004, “On the Fight against Money Laundering and Terrorist Financing” (“AML/CFT Law”). According to Articles 1(20c) and 7-1(1) of the AML/CFT Law, organizations established or providing services in Luxembourg must register with CSSF if they offer one or more services listed as VASP services on behalf of or for their clients. Any organization, including those already licensed/registered with the competent authority, especially licensed financial institutions, offering or intending to offer any VASP services from March 30, 2020, onward must:

1. Pre-register as a VASP.
2. Comply with the professional obligations and conditions outlined in the AML/CFT Law with amendments.  

Procedure:

1. The registration procedure generally starts with a meeting at the CSSF premises aiming to present the applicant and its project. Depending on the activities of the project, registration as a VASP may be necessary.
2. In case the applicant submits a formal registration file to the CSSF for registration, it must include all the documents and information required by using the relevant forms made available on the CSSF website (application).
3. The registration file shall exclusively be provided to the CSSF in an electronic form via the MFT (Managed File Transfer) system of the CSSF, for which the required link will be provided to the applicant by the CSSF (upon request to the following email address ipig@cssf.lu). The CSSF then examines the registration file.
4. The registration is effective upon inclusion of the applicant in the CSSF register. After the registration has been completed, the registered entity is published in the national public register maintained by the CSSF.
5. If, after the registration, significant changes to the activities or to the key function holders notified upon registration occur, the registered entity has to immediately inform the CSSF in writing.   

The request for registration to the CSSF shall include the following information:

1. For an applicant legal person:
   1. The name of the applicant.
   2. The precise address of the central administration of the applicant.
   3. A description of the activities performed, in particular, a list of the types of virtual asset services envisaged and their relevant qualification.
   4. A description of the money laundering and terrorist financing risks to which the applicant will be exposed and the internal control mechanisms established by the applicant in order to mitigate these risks and to comply with the professional obligations defined in this law and in Regulation (EU) 2015/847, or in their implementing measures. 
   5. At least two persons must be responsible for the management of the virtual asset service provider and entitled to effectively determine the policy of the business. These persons shall possess adequate professional experience.

Is there any specific authorization required for a VASP from another EU member state to provide services in this jurisdiction?

Any person, natural or legal, who is established in Luxembourg and/or provides in Luxembourg any of the VA-related services on behalf of customers or for its customers, must register as a VASP in the CSSF register.

What is the liability for the activities of a VASP from another EU member state without local registration/authorization in this jurisdiction?

Pursuant to the Section 2 – Administrative enforcement, Article 8-4 of the Law of 12 November 2004 on the fight against money laundering and terrorist financing

The supervisory authorities have the power to impose administrative sanctions and to take other administrative measures laid down in paragraph 2 with respect to the professionals subject to their respective supervisory powers in accordance with (….) 7-1(2) or their implementing measures, as well as with respect to the members of their executive bodies, effective directors (dirigeants, members of the authorized management) or other persons responsible for the non-compliance by the professionals with their obligations. 

In the event of a breach referred to in paragraph 1, the supervisory authorities shall have the power to impose the following administrative sanctions and to take the following administrative measures: 

1. A warning.
2. A reprimand.
3. A public statement which identifies the natural or legal person and the nature of the breach.
4. Where the professionals are subject to “registration” or authorisation“, initiate the procedure for” the withdrawal or suspension of that “registration or” authorisation.
5. A temporary ban, imposed by the CSSF and the CAA, for a period not exceeding 5 years:
   1. To exercise a professional activity of the financial sector or to carry out one or several transactions with respect to the persons subject to their respective supervisory powers in accordance with Article 2-1.
   2. To exercise managerial functions within the professionals subject to their respective supervisory powers in accordance with Article 2-1 with respect to any person discharging managerial responsibilities within such professionals or any other natural person held liable for the breach.
6. Maximum administrative fines of twice the amount of the benefit derived from the breach, where that benefit can be determined, or EUR 1,000,000 at the most.

Manimama Legal & Growth Agency provides a gateway for the companies operating as the virtual asset wallet and exchange providers allowing to enter to the markets legally. We are ready to offer an appropriate support in obtaining a license with lower founding and operating costs. We offer KYC/AML launch, support in risk assessment, legal services, legal opinions, advice on general data protection provisions, contracts and all necessary legal and business tools to start business of virtual asset service provider.

The content of this article is intended to provide a general guide to the subject matter, not to be considered as a legal consultation.