On September 19th, 2024, the CSSF published its 2023 annual report, highlighting key regulatory challenges, particularly in the realm of crypto-assets following the implementation of the Markets in Crypto-Assets Regulation (MiCA). MiCA introduces a unified legal framework across the EU, bringing much-needed legal clarity and enhanced protection for consumers and investors in this rapidly evolving sector. However, it also exposes new regulatory gaps, such as the rise of illegal cryptocurrency providers operating from outside the EU, often via social media and influencers. Addressing these cross-border threats will require coordinated efforts, with regulators like the CSSF needing to intensify digital monitoring and collaborate with the European Supervisory Authorities (ESAs).
In addition, Luxembourg’s recent evaluation by the Financial Action Task Force (FATF) highlighted the country's strong anti-money laundering and counter-terrorism financing (AML/CFT) framework, while also identifying areas for further improvement, particularly in combatting the financing of terrorism.
In this complex and shifting regulatory landscape, the role of the lawyer has never been more crucial. At Goodwin, our team of expert lawyers is here to guide you through these regulatory changes, ensuring that your crypto-related activities are fully compliant with MiCA and other EU regulations. We not only help businesses navigate new rules but also anticipate risks, providing proactive strategies to manage cross-border challenges. Our deep expertise in AML/CFT and digital regulation allows us to offer comprehensive, tailored legal support to safeguard your business and ensure compliance with the highest regulatory standards across Europe.
I/ Financial Innovation
- MiCA Regulation:
The MiCA regulation, which came into effect on June 29, 2023, defines a framework for the authorization and prudential supervision of crypto-asset issuers and service providers that fall within its scope. It will be implemented in two phases: June 30, 2024, for stablecoin issuers and December 30, 2024, for the rest of its provisions.
The CSSF has identified the tasks to be integrated into its internal organization to meet its obligations, considering the cross-cutting nature of the MiCA regulation's impacts, which will affect both unsupervised entities and others already under its supervision.
In this context, the CSSF has chosen to rely on the existing division of competencies within its teams and has created an internal working group to adopt a harmonized approach and address common issues arising from the MiCA regulation. This internal working group, to which the Innovation Hub and departments affected by the new regulation contribute, has as its primary mission to coordinate the implementation of the MiCA regulation within the CSSF. The group also facilitates compliance efforts related to cross-cutting provisions, which may involve developing or adapting internal procedures, circulars, guidelines, or external publications. It serves as the internal exchange platform for addressing practical cross-cutting issues related to the implementation of the MiCA regulation and provides assistance to departments on specific questions. Given its coordination mission, the Innovation Hub is a key member of this group and contributes to its efforts by structuring exchanges, providing training, or offering case-by-case guidance or practical support.
- The Innovation Hub
The Innovation Hub is the single point of contact of the CSSF. The Innovation Hub's missions are central to these themes and aim to provide internal and external guidance to support the digital transition of the financial sector. As the CSSF's single point of contact, the Innovation Hub has strengthened its ties with FinTechs and established players to foster dialogue on financial innovation. In 2023, the Innovation Hub was approached by 53 project entities seeking guidance or concrete support for registration or licensing. These entities may be based in Luxembourg or in other jurisdictions with the aim of establishing themselves in Luxembourg.
The Innovation Hub supports many startups that contact it in the early stages of their projects. This contact allows them to be guided concerning the regulatory framework applicable to them and the best way to interact with the regulator when the project reaches maturity, i.e., when legal memorandums and proof-of-concept are established. In return, this proactive interaction allows the Innovation Hub to stay close to the latest trends in the Luxembourg financial market and adjust its internal priorities around relevant themes as needed.
- Tokenization – Security Tokens
Most projects submitted to the Innovation Hub involve crypto-assets and the application possibilities of Distributed Ledger Technology (DLT). Business models involving tokenization use the issuance of digital tokens that grant certain rights to their holders in exchange for their participation in the project’s financing. These rights are freely defined and can take various forms, so it is essential that the project initiator provides the CSSF with a detailed opinion that determines all rights attached to the tokens, thereby justifying the claimed legal qualification.
- Crypto-Assets
Given the limited number of projects submitted to the Innovation Hub by financial sector professionals already authorized by the CSSF, it is not possible to assess the interest in crypto-assets under the MiCA regulation or determine the appetite of traditional actors for this sector.
- New Challenges
In order to effectively address the impact of emerging regulations on the financial sector, while maintaining the security and stability of the market, protecting consumers, and managing risks, a proactive and strategic approach is essential. This includes providing clarity around new financial activities and implementing robust risk mitigation measures. Centralizing inquiries from industry stakeholders and developing harmonized responses will be crucial for ensuring regulatory consistency.
In this context, the role of the lawyer is pivotal. At Goodwin, our legal experts not only offer guidance on compliance with new regulations but also help clients anticipate and adapt to regulatory changes. By centralizing and addressing key concerns from the financial sector, our team is well-equipped to deliver harmonized solutions that align with evolving regulatory expectations, while safeguarding business operations in this fast-changing landscape.
II/ Banking Supervision
Prudential supervision in the strict sense includes the supervision of solvency, liquidity, and internal governance. In 2023, 130.65 full-time equivalents (129.45 in 2022) directly contributed to the various banking supervision activities at the CSSF. For the aforementioned control areas, CSSF agents also actively participate in working groups at the European and international levels.
- Priorities in Prudential Supervision and Banking Risks
The main activity of banks offering wealth and asset management is the custody and management of their clients' financial assets. The main risks associated with this type of banking activity are operational in nature and include, in addition to AML/CFT risk, IT risk, such as cyber risk, resilience risk (business continuity), and risks related to the use of sub-custodians and outsourcing. Moreover, increasing digitalization and new technologies such as DLT, digital payments, or cryptocurrencies bring new challenges, both strategic and operational.
In 2023, the CSSF deepened its understanding of banks' digital transformation projects and existing and emerging IT risks, particularly by monitoring cyber incidents.
III/ Financial Crime
In 2023, the CSSF also increased the number of Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) supervisory missions targeting professionals offering innovative services and activities, such as payment institutions, electronic money institutions, and crypto-asset service providers. The number of clients, combined with services that are primarily digital, exposes these professionals to new AML/CFT risk typologies, resulting in an inherently high risk for these sectors. It is therefore necessary to establish an appropriate control environment based on efficient and automated IT tools, enabling proper and proportionate monitoring of their activities.
- Updates on the European Legal and Regulatory Framework for AML/CFT and Financial Sanctions
On April 24, 2024, the European legislative package against money laundering and terrorist financing, proposed in 2021, was adopted by the European Parliament following an interinstitutional agreement reached in January 2024. The regulation (EU) 2023/1113, concerning the information accompanying fund transfers and certain crypto-assets and amending directive (EU) 2015/849, was already adopted in May 2023 and is part of the package. This regulation, which aims to increase transparency in payments, constitutes one of the four pillars of the legislative package. The other three initiatives include a revision of the 4th AML/CFT directive, a European regulation introducing a rulebook concerning professional obligations, and a European regulation establishing a new European authority for AML/CFT (AMLA). In summary, this package aims to introduce or strengthen within the EU:
- A more consistent and uniform application of professional rules and sanctions in case of violations.
- Enhanced transparency, particularly through verified information on beneficial owners and the scope of information to be included in the account and safe deposit registers.
- An authority (AMLA) based in Frankfurt, endowed with supervisory and investigative powers to ensure compliance with AML/CFT requirements.
These texts will be further elaborated in the coming years through additional legal/technical acts and guidance from the future AMLA. Luxembourg's legislative and regulatory framework for AML/CFT will be reviewed based on this package once all the relevant texts are published.
IV/ Financial Consumer Protection
- Financial Consumer Protection and Financial Education at the National Level
As part of its mission for financial education, the CSSF has continued to develop its information portal (http://www.letzfin.lu), which contains a wealth of information on personal finance. Given the need to raise public awareness about sustainable finance, the CSSF engaged in an educational effort by launching a national awareness campaign in collaboration with the ABBL Foundation for Financial Education, the Luxembourg Investment Fund Association (ALFI), and the Ministry of Consumer Protection. The objective was to make the public aware of the existence of sustainable investments, inform them better about various dimensions beyond green finance (such as the full spectrum of ESG—Environment, Social, and Governance), and help them understand that they can have a positive impact on society and the planet through their investment choices.
In this public awareness context, the CSSF published short "True or False?" videos on topics related to sustainable finance and over-indebtedness. In the context of World Investor Week, initiated by IOSCO (International Organization of Securities Commissions), the CSSF published an animated video to better understand the risks associated with cryptocurrencies. Additionally, to raise awareness among young residents about fraud related to crypto-assets and other investments, an influencer marketing campaign was carried out.
Luxembourg also participated for the first time in the international OECD/INFE study on financial literacy. The representative survey was initiated by the CSSF and the ABBL Foundation for Financial Education and conducted by the ILRES polling institute. The study reveals that in Luxembourg, only 53% of the population has achieved the minimum score required to manage their finances autonomously. While the overall results are mixed for the entire population, they are particularly concerning for young people aged 18 to 29. In terms of financial knowledge, young Luxembourgers scored below the average for young people in participating countries.
- Financial Consumer Protection and Financial Education at the International Level
a) Task Force on Consumer Protection of the OECD Committee on Financial Markets
The work of this Task Force focuses on the G20's High-Level Principles on financial consumer protection, which have numbered twelve since December 2022. In 2023, the Task Force worked to disseminate the updated principles. The Task Force also focused on sustainable finance, which led to the publication of a report on July 24, 2023, titled "Financial Consumers and Sustainable Finance: Policy Implications and Approaches." This report, to which the CSSF contributed, explores the opportunities and challenges for consumers of financial products related to sustainable finance. It examines current trends in consumer demand and experience with sustainable financial products, as well as the new risks these products pose to consumers.
The Task Force also addressed the digitization of the financial sector by organizing two roundtable discussions on the topics "Digitization: Latest Developments in Artificial Intelligence in Consumer Financial Products and Services" and "Digitization: Developments in Crypto-Assets (non-CBDC)."
b) International Financial Consumer Protection Network (FinCoNet)
FinCoNet is an international organization bringing together supervisory authorities from 32 countries responsible for financial consumer protection. Its purpose is to encourage the exchange of information and cooperation between supervisory authorities to promote good market conduct and strong consumer protection in the financial sector.
In 2023, FinCoNet published several documents on financial consumer protection, including three briefing notes titled "Market Conduct Supervisory Implications of Non-Traditional Financial Entities Offering Financial Services, Especially Payments," "Mortgage Distribution—Sales Incentives, Consumer Outcomes, and Supervisory Approaches," and "Impact of COVID-19 on Market Conduct Supervision," as well as a summary report titled "Seminar on Developments in Central Bank Digital Currencies and Issues for Consumers."
As a member of FinCoNet, the CSSF also participated in two international seminars. The first, held on March 22, 2023, focused on the evolution of central bank digital currencies and the issues they pose for financial consumers. The second seminar, held on November 24, 2023, allowed regulators to exchange views on market conduct supervision during challenging periods.
c) International Network on Financial Education (INFE) of the OECD
This international network, created by the OECD, aims to promote and facilitate international cooperation among various stakeholders (policymakers, regulators, associations, etc.) concerned with financial education. In 2023, 282 institutions from 131 countries were represented within INFE, with 98 authorities, including the CSSF, holding full membership status.
In 2023, the OECD/INFE and the European Commission jointly published a common financial competence framework for children and young people, with the aim of achieving a common vision among EU member states on the key financial competencies that children and young people should possess at different ages. This document is intended to serve as a basis for developing programs and teaching materials for children and young people as part of financial education in different member states.
The OECD/INFE also published a report titled "Financial Consumers and Sustainable Finance," which analyzes the issues, opportunities, and challenges faced by consumers of financial products in the realm of sustainable finance.
d) Committee 8 on Retail Investors of IOSCO
The committee's main mandate is to carry out IOSCO's work related to financial education. Its secondary mandate is to advise the IOSCO Board on investor protection issues and to work on policy implementation in this area. In 2023, two working groups were established to address the topics of crypto-assets and financial influencers (finfluencers). Another working group focused on organizing World Investor Week.
Conclusion
To conclude, the CSSF's 2023 annual report underscores the dynamic landscape of Luxembourg’s financial sector, with a clear emphasis on navigating the complexities brought by technological innovation and regulatory developments. The MiCA regulation represents a pivotal moment for crypto-assets, offering enhanced investor protection while presenting new challenges in the regulation of illicit cryptocurrency activities. At the same time, the CSSF has reinforced its focus on anti-money laundering (AML) and counter-terrorism financing (CFT), particularly in sectors driven by innovation, ensuring compliance with international standards.
At Goodwin, we bring deep expertise in financial regulation and fintech, and are well-positioned to guide your business through the intricacies of MiCA compliance and CSSF expectations. Whether you are navigating crypto-assets, AML requirements, or the evolving regulatory framework, our team is ready to provide tailored legal solutions that safeguard your operations and help you meet the highest regulatory standards. We look forward to partnering with you to ensure your activities remain compliant in this fast-evolving landscape.
This informational piece, which may be considered advertising under the ethical rules of certain jurisdictions, is provided on the understanding that it does not constitute the rendering of legal advice or other professional advice by Goodwin or its lawyers. Prior results do not guarantee a similar outcome.
