As part of its 2025 National Risk Assessment (NRA), Luxembourg has designated cryptocurrency firms, especially VASPs (Virtual Asset Service Providers), as high-risk money laundering entities. A classification based on various worrying factors like high transaction volume, global reach, and inconsistent anti-money laundering (AML) compliance.
Crypto activities “are Internet-based and decentralized, making regulatory oversight difficult and the tracking of illegal funds difficult,” the report said. Authorities cited insufficient adherence to essential AML practices, such as customer due diligence, transaction monitoring, and suspicious activity reporting.
Some Luxembourg-based companies appeared inadequately informed to comprehend their AML obligations. Others did not comply at all with basic regulatory obligations. The report notes that Luxembourg financial supervisor Commission de Surveillance du Secteur Financier (CSSF) has limitations in monitoring the fast-paced and complex crypto sector.
This latest report comes on the heels of previous assessments in 2020 and 2022 that pointed to serious vulnerabilities in the crypto industry to financial crime. Still, the 2025 report takes a firm stance that may lead to tighter monitoring and more resources to fight money laundering backed by cryptocurrencies.
As per the timeline for full application of Markets in Crypto-Assets (MiCA), Europe will be ready with technical means in mid-2026. Luxembourg will let the firms work for an 18-month transitional period while they adjust to the new rules cautiously.
Some major crypto firms are already aligning with MiCA. In May 2025, the exchange Bitstamp gained a CAC (crypto-asset service provider) license from the CSSF, becoming one of the first exchanges to do so. UK-based banking giant Standard Chartered will build a digital asset custody hub in Luxembourg due to MiCA, it said.
Even though crypto transaction volumes have shrunk recently, authorities continue to believe the industry is susceptible to financial crime. High-profile investigations in Europe recently resulted in many arrests and seizures tied to crypto-based money laundering schemes, worth millions of euros.
The results of the NRA strongly point to Luxembourg adopting stricter standards of compliance in the future, even if not named. Cryptocurrency businesses operating in or through the country should prepare for intensified scrutiny, provide more guidance, and encourage transparency.
