CSSF FAQ on virtual asset service providers

On 17 August 2023, the Commission de Surveillance du Secteur Financier (the «CSSF») published its frequently asked questions (the "FAQ") on virtual asset service providers ("VASPs") with the aim of clarifying questions from VASPs or entities willing to register as VASPs with respect to the legal AMF/CTF framework applicable to VASPs.

Among the answers provided by the CSSF, we would highlight following key points:

• Any person, natural or legal, who is established in Luxembourg and/or provides in Luxembourg any virtual asset ("VA") related services on behalf of customers or for its customers, must register as a VASP in the CSSF register. The VA-related services are (i) exchange between VA and fiat currencies, including the service of exchange between virtual currencies and fiat currencies, (ii) exchange between one or more forms of VA, (iii) transfer of VA, (iv) safekeeping or administration of VA or instruments enabling control over VA, including custodian wallet service, (v) participation in and provision of financial services related to an issuer's offer or sale of VA.

• The CSSF gave a set of internal criteria used to assess whether an entity, which is not established in Luxembourg and providing services in Luxembourg must register as VASP. The criteria are, among others but not limited to: (i) having an active commercial approach to Luxembourg's market, (ii) having a physical presence in Luxembourg either with an office, representatives or part of its technological infrastructures in Luxembourg (iii) having a distribution network in Luxembourg and relying on intermediaries either authorised or not to seek customers, (iv) having contact details in Luxembourg such as dedicated phone lines and v) offering the services on a durable and continuous basis;

• No passporting regime is foreseen under the European / national regime;

• The level of information expected to be submitted as part of the money laundering and terrorist financing risk assessment: The risk assessment must take into consideration at a minimum the following risk factors: the customers, the countries or geographic areas, the products (including without being limited to the VA), services, transactions and the delivery channels. The risk assessment must be based on a variety of sources of information and at a minimum the Supra-National Risk Assessment of the European Commission, the Luxembourg National Risk Assessments, the Luxembourg Vertical Risk Assessment for VASPs and the joint guidelines issued by the European Supervisory Authorities (ESMA, EBA and EIOPA) on money laundering and terrorist financing risk factors;

• The expectation in terms of monitoring of the transactions:  the process for monitoring transactions must in principle be supported by automated tools, however the implementation of a manual process is possible if the VASP can prove that the (i) volume, (ii) the nature of the customers, (iii) the nature of the transactions to be supervised do not require such automation. Good market practices are to implement "ex ante" and "ex post" controls. In particular, "ex ante" controls allow to detect suspicious transactions before they are processed. "Ex post" may also consist among others of examining the history of transactions and potentially detecting suspicious patterns. The CSSF requirements regarding processes are technologically neutral.

• VASPs must report promptly to the Financial Intelligence Unit any suspicious activities or transactions they discover and for which they have reasonable grounds to suspect that money laundering, an associated predicate offence or terrorist financing is being committed or has been committed or attempted ;

• VASPs must comply with the legal framework related to international financial sanctions such as (i) the Law of 19 December 2020 on the implementation of restrictive measures in financial matters, (ii) the CSSF regulation 12-02 in particular article 33 and 39 on controls and measures to put in place, (iii) restrictive measures in financial matters, including those implemented in Luxembourg via EU regulations or UN resolutions directly applicable without further notice and through the adoption, among others, of ministerial regulations. VASPs must inform the Ministry of Finance of the enforcement of each restrictive measure taken in respect of a State, natural or legal person, entity or group involved in a transaction or business relationship and designated in accordance with the Law 2020 and the implementing regulations, including attempted transactions.

• There is no fee for registering as VASP with the CSSF however, an annual supervisory fee of EUR15,000 will be requested by the CSSF; and

• The CSSF's role for the registered VASPs is currently limited to registration, supervision and enforcement for AML/CTF purposes only. Once the VASP is registered with the CSSF, the CSSF has all the supervisory and investigatory powers as well as sanctioning powers.