Luxembourg funds and crypto assets: understanding the CSSF’s latest clarifications 

On 4 February 2026, the CSSF updated its FAQ on (virtual) crypto assets providing significant clarifications for funds and fund managers.

Up to 10% of the NAV: crypto assets as eligible investment for UCITS and retail AIFs

UCITS may now invest indirectly up to 10% of their NAV in crypto

UCITS may invest indirectly in crypto-assets for a maximum of up to 10% of their net asset value (NAV) as long as these investments (indirect investments in financial instruments with crypto-assets as an underlying asset) qualify, at all times, as transferable securities that do not embed any derivatives.

It is important to note that any assets that qualify as financial instruments, such as shares of companies active in the crypto asset ecosystem, are not subject to the above position.

Retail AIFs may invest directly and indirectly up to 10% of their NAV in crypto

AIFs open to retail investors other than well-informed investors may invest directly and indirectly in crypto assets for a maximum of up to 10% of their NAV.

Where a UCITS or AIF intends to invest in crypto assets, it must inform the CSSF and investors of such plans in a timely manner, and update relevant fund documentation. Furthermore, the management company or an AIFM of such UCITS or AIF must ensure adequate internal control functions and make a case-by-case assessment of the impact of these investments on the risk profile of the investment fund. 

Authorization requirements: crypto licenses required only for fund managers investing more than 10% of the NAV in crypto

Each Luxembourg authorized IFM which intends to manage AIFs (regulated or not), investing in crypto assets beyond 10% of their NAV, needs to obtain prior authorization from the CSSF for the strategy “Other-Other Fund-Crypto-assets”.

Obligations applicable when investing in target funds with underlying in crypto assets

Even though no application for the “Other-Other Fund-Crypto-assets” license is required for a Luxembourg IFM managing an AIF investing in crypto assets through one or several target funds (TFs), considering the risks related to such investment, the CSSF requires that in relation to each TF with crypto assets as the main underlying exposure,¹ the IFM undertakes an assessment of the ability of the TF’s manager to identify and manage the risks pertaining to investments in crypto assets. The assessment should include the operational risks arising from the activities of the parties which intervene in the administration, notably the registrar and transfer function, and custody of the crypto assets. The IFM should be able to provide the CSSF with the results of its assessment on demand. 

Note that an investment in crypto assets through one or several TF constitutes an indirect investment in crypto assets, subject to all the conditions mentioned in the first section.

AML considerations

The Responsable du Contrôle (RC) and the Responsable du Respect (RR) of the entities investing in crypto assets must possess and be able to demonstrate an adequate understanding of the new ML/TF, proliferation financing risks posed by crypto assets and the necessary measures to mitigate them. In this context, professionals are encouraged to take into account the Vertical Risk Assessment on Virtual Assets Service Providers published in December 2020. Depending on the type of investment (direct or indirect), the type of crypto asset and the method of acquisition, the level of ML/FT risk as well as the due diligence will vary. The key outcome of the due diligence on crypto assets is to understand where the crypto assets are coming from and/or where they are going (buy/sell side) in order to mitigate the risk of the investment fund being abused by money launderers or terrorism financers.

How are depositaries affected?

Luxembourg fund depositaries may be mandated to act as depositary for investment funds investing directly in crypto assets. In such scenario, depositaries must put in place adequate organizational arrangements and an appropriate operational model, considering the specific risks related to the safekeeping of crypto assets. Furthermore, depositaries must notify the CSSF beforehand. In relation to depositary services, for crypto assets that qualify as “other assets”, the depositary’s liability in its depositary function is limited to safekeeping duties regarding ownership verification and record keeping.

Where the depositary does not offer the service of custody and administration of crypto assets on behalf of clients pursuant to MiCAR, the IFM/investment fund directly appoints a specialized crypto asset service provider offering these services. In this instance, the crypto assets are not recognized in the depositary’s off-balance sheet, as the depositary is not liable for the restitution of the assets. Indeed, this liability is directly incumbent on the crypto-asset service provider. To that effect, the IFM/investment fund is required to have a direct contractual relationship with the crypto-asset service provider. 

A depositary providing the service of custody and administration of crypto-assets on behalf of clients to an investment fund investing directly in crypto-assets triggers either an authorization as a crypto-asset service provider or a notification. Under this setup, crypto assets are recognized in the off-balance sheet and the depositary has specific obligations pursuant to MiCAR. 

Depositaries that envisage directly safeguarding crypto assets are required to inform the CSSF of such plans in a timely manner.