Luxembourg has officially labeled cryptocurrency firms, particularly Virtual Asset Service Providers (VASPs), as “high-risk” entities for money laundering in its 2025 National Risk Assessment (NRA).
According to the report, VASPs are considered inherently susceptible to misuse due to several risk factors.
A key vulnerability noted is the ease with which digital assets can be transferred across jurisdictions with minimal regulatory oversight. This makes the sector attractive for money laundering operations, especially involving proceeds from cybercrime, fraud, tax offenses, and corruption.
The report indicates that VASPs often operate in a decentralized environment, which impedes adequate supervision and complicates the identification of illicit financial flows.
Regulatory authorities, including the Commission de Surveillance du Secteur Financier (CSSF), have undertaken oversight efforts. However, the report warns of capacity constraints and the need for improved supervisory tools tailored to the fast-evolving crypto industry.
In other instances, firms failed to meet essential compliance obligations such as customer due diligence, ongoing transaction monitoring, and reporting suspicious transactions.
The report also cites cases where some VASPs in Luxembourg were registered without adequate understanding or application of AML rules.
The country has opted for a cautious, methodical rollout, taking full advantage of MiCA’s 18-month transitional period, which extends from December 30, 2024, to July 1, 2026. This transition period allows existing Virtual Asset Service Providers (VASPs) to continue operations while gradually adapting to MiCA’s new compliance standards.
As of May 2025, Luxembourg has not published official figures on the number of Crypto-Asset Service Providers (CASPs) authorized under the European Union’s MiCA regulation.