An extract from The Virtual Currency Regulation Review, 3rd Edition

Introduction to the legal and regulatory framework

As a globally recognised financial centre with international outreach, Luxembourg has positioned itself as a world leader in the sphere of digital financial services and as a financial technology hub.2 It has always considered innovation as an essential driver for the development of financial services and the financial sector in general. With this mindset, in 2019 it adopted a law that clearly states that securities can be legally held and transferred through distributed ledger technologies,3 thus adding one more layer to its long tradition of 'innovation through law', of which legal certainty is one of the essential pillars. It was also the first country in Europe to license virtual currency exchange platforms as payment institutions.

If the issuing of virtual currencies as such is not subject to authorisation, the service provided by the intermediary – receiving funds from the buyer of Bitcoin to transfer them afterwards to the seller – is covered by the authorisation as a payment institution. This authorisation echoed the opinion of the Financial Sector Supervisory Commission (CSSF), which in 2014 was the first financial sector regulator that was in favour of the regulation of platforms for the exchange of virtual currencies when carrying out an activity of the financial sector.4 In a press release dated 14 February 2014, the CSSF considered that activities such as the issuing of means of payments in the form of virtual or other currencies, the provision of payment services using virtual or other currencies, and the creation of a market (platform) to trade virtual or other currencies, are to be defined as being financial activities, and that any person wishing to establish in Luxembourg to carry out such an activity has to receive a ministerial authorisation. On 19 April 2016, the Minister of Finance authorised Bitstamp Europe SA, a platform allowing its clients to exchange Bitcoins, euros and US dollars. bitFlyer, a Japanese virtual currencies exchange platform, was granted a licence in January 2018.

A consumer warning on virtual currencies issued by the CSSF on 14 March 2018 reiterated this position by asserting that, even though there is currently no legal framework in Luxembourg that specifically applies to virtual currencies, it should be borne in mind that any provision of financial sector services by a natural or legal person requires an authorisation by the Minister of Finance.5

In another consumer warning on initial coin offerings (ICOs) and tokens, issued on the same date, the CSSF acknowledges that raising funds from the public in the form of initial coin offerings (ICOs) is not subject to a specific regulation, and does not benefit from any guarantee or other form of regulatory protection. The CSSF considers further that despite the lack of specific regulations applying to ICOs, the activities related thereto or relating to the creation of tokens, and the collection and raising of funds may, depending on their characteristics, be subject to certain legal provisions and thus to a number of supervisory requirements.6

The CSSF specifies in the warning that it will:

assess such fundraising activities by extending its analysis to the objectives pursued in order to assess whether it could be a scheme to circumvent or avoid financial sector regulations, notably the provisions of the Law of 10 July 2005 on prospectuses for securities and the Law of 5 April 1993 on the financial sector. The CSSF considers that for any fundraising, the initiators of such ICOs are required to establish anti-money laundering and terrorist financing procedures.

The Law of 25 March 2020, amending the Law of 12 November 2004 on the fight against money laundering and terrorist financing (the AML/CTF Law), introduces new registration and governance requirements for virtual asset service providers (VASPs) and provides legal definitions related to VASPs, virtual assets, virtual currencies, safekeeping or administration service providers and custodian wallet providers.

Hence, VASPs are entities providing for, or on behalf of, their customers, one or more of the following services:

  1. exchange between virtual assets and fiat currencies, including the service of exchange between virtual currencies and fiat currencies;
  2. exchange between one or more forms of virtual assets;
  3. transfer of virtual assets;
  4. safekeeping or administration of virtual assets or of instruments enabling control over virtual assets, including custodian wallet services; and
  5. participation in and the provision of financial services related to the offer of an issuer or the sale of virtual assets.7

In accordance with the AML/CTF Law, 'virtual asset' shall mean a digital representation of value, including a virtual currency, that can be digitally traded or transferred and can be used for payment or investment purposes, except for virtual assets that fulfil the conditions of electronic money within the meaning of point 29 of Article 1 of the Law of 10 November 2009 on payment services (the Law on payment services), as amended, and the virtual assets that fulfil the conditions of financial instruments within the meaning of point 19 of Article 1 of the Law of 5 April 1993 on the financial sector, as amended (the Law on the financial sector).8

The AML/CTF Law defines a 'virtual currency' as a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency and does not possess a legal status of currency or money, but is accepted by persons as a means of exchange and which can be transferred, stored and traded digitally.9

'Safekeeping or administration service provider' shall, in accordance with the AML/CTF Law, 'mean the safekeeping or administration service provider of virtual assets or instruments enabling control over virtual assets, including the service of wallet custody'.10

A 'custodian wallet service' is defined as a service to safeguard private cryptographic keys on behalf of customers, to hold, store and transfer virtual currencies.11

The AML/CTF Law designates the CSSF as the competent supervisory authority for virtual assets and VASPs. The CSSF's role in this context is limited to registration, supervision and enforcement for anti-money laundering (AML) and counter-terrorist financing (CTF) purposes only.12

Securities and investment laws

In its warning on ICOs, the CSSF has not provided for a classification of tokens or cryptocurrencies underlying ICOs as financial instruments or otherwise. The CSSF at the same time acknowledges that this type of activity might be subject to supervisory requirements in Luxembourg.

The CSSF warning is in line with the European Securities and Markets Authority (ESMA) position on ICOs.13 ESMA also considers that firms involved in ICOs must give careful consideration to whether their activities constitute regulated activities. If this is the case, firms have to comply with the relevant legislation, and any failure to comply with the applicable rules would constitute a breach.

Actors who would like to provide services related to tokens, be it dealing with tokens or publicly offering those tokens within a regulated financial framework, should be allowed to do so as long as all applicable legal requirements are fulfilled.

According to an ESMA paper dated November 2017, the features and purpose of coins or tokens vary across ICOs. Some coins or tokens serve to access or purchase a service or product that the issuer develops using the proceeds of the ICO. Others provide voting rights or a share in the future revenues of the issuing venture. Some have no tangible value. Some coins or tokens are traded or may be exchanged, or both, for traditional or virtual currencies at specialised coin exchanges after issuance.14

ICO campaigns are conducted online, using the internet and social media. The coins or tokens are typically created and disseminated using distributed ledger or blockchain technology. ICOs are used to raise funds for a variety of projects, including but not limited to businesses leveraging on a distributed ledger. Virtually anyone who has access to the internet can participate in an ICO.15

Commonly, the following three types of tokens can be identified within an ICO context:16

  1. Payment or cryptocurrency tokens: these are intended to be used, now or in the future, as a means of payment for acquiring goods or services, or as a means of money or value transfer. Cryptocurrencies give rise to no claims on their issuer.17 Payment tokens are subject to the Law on payment services.18
  2. Utility tokens: these provide access digitally to an application or service by means of a blockchain-based infrastructure.19
  3. Asset tokens: these represent assets such as a debt or equity claim on the issuer. Asset tokens promise, for example, a share in a future company's earnings or future capital flows. In terms of their economic function, therefore, these tokens are analogous to equities, bonds or derivatives. Tokens that enable physical assets to be traded on a blockchain also fall into this category.20

Taking as a starting point the CSSF's warning on ICOs, and in particular the statement that asset tokens might be subject to regulatory supervision in line with the position taken by several European countries with regard to ICOs,21 it is our view that, depending on the nature of the token, an ICO could fall, among others, within the remit of the amended Law on the financial sector, the amended Law of 30 May 2018 on markets in financial instruments, the amended Law of 17 December 2010 relating to undertakings for collective investment and the amended Law of 10 July 2005 on prospectuses for securities.

We therefore consider that asset tokens need to be analysed with respect to the concept of financial instruments and the laws and regulations applicable thereto.22 Depending on the structure of a token, the latter may qualify as a transferable security, a unit in a collective investment undertaking or a token could serve as the underlying asset for a derivative contract.

Tokenisation of securities in Luxembourg has been given a serious push by the legislator through the adoption of the Law of 1 March 2019 amending the Law of 1 August 2001 concerning the circulation of securities. In its new Article 18 bis, the Law provides that securities can be held using distributed ledger technologies and these technologies can also be used to register transfers.

i Transferable security

The amended Law of 30 May 2018 on markets in financial instruments23 defines transferable securities as those classes of securities that are negotiable on the capital market, with the exception of instruments of payment, such as:

  1. shares in companies and other securities equivalent to shares in companies, partnerships or other entities, and depositary receipts in respect of shares;
  2. bonds or other forms of securitised debt, including depositary receipts in respect of such securities; and
  3. any other securities giving the right to acquire or sell any such transferable securities or giving rise to a cash settlement determined by reference to transferable securities, currencies, interest rates or yields, commodities or other indices or measures.

According to this definition, if a token is transferable, negotiable and embodies certain rights, it can prima facie be defined as a security in the following situations.

  1. With regard to transferability, the Finance Working Group of the Blockchain Bundesverband considers in its statement24 that transferability means that units can be assigned to another person, irrespective of the existence of a certificate that registers or documents the existence of the units. These concepts can be applied mutatis mutandis for Luxembourg. The important point is that the transfer can be made and registered without the need for a written document.25
  2. With regard to negotiability, such term needs to be analysed against the classical background of negotiability of securities. Securities are negotiable, in particular, when they are traded on exchanges or platforms.26
  3. As to the rights attached to the tokens, these need to be share-type rights, bond-type rights or rights that allow for the acquisition or sale of the above-mentioned type of security or rights related thereto.

A three-factor test can be applied to a token to determine whether it qualifies as a security:27

  1. The first factor is related to the economic rationale behind the issuing of the token. Why is the token issued? What is the project behind? Is it a business or economic project? What is the objective of the issuer?
  2. The second factor is related to the rights of the token owner. Are these share-type or bond-type rights?
  3. The third factor is linked to the purpose of the buyer or seller. Why is he or she buying the token? Is the holder participating in the profits made? Does he or she have an interest in the economic and financial development of the company or the project?

This test will be relevant and will assist in determining whether a token is a security. In practice, it could well be that the second and third factors (points (b) and (c) above) coincide in many instances.

The investment substance has to be considered. If in substance a token corresponds to a security and produces effects similar to those of a security, it has to be regulated like a security.28 It should not be possible to argue that, because of the innovative character of tokens and owing to their underlying technology, they would be exempted from complying with financial regulation, specifically (but not exclusively) with regard to investor protection and AML/CTF aspects.29

ii Unit in a collective investment undertaking

A token could also be structured in such a way as to qualify as a unit in an investment fund, as defined by the amended Law of 17 December 2010 relating to undertakings for collective investment. A token could also be based on or represent a unit in a collective investment undertaking.

iii Underlying asset for a derivative contract

A token could also be used as an underlying asset for a derivative contract.30 In that case, the derivative contract would classify as a financial instrument.31

In line with the ESMA paper, one of the conclusions of the qualification of tokens as financial instruments is that the firms involved in ICOs conduct regulated investment activities such as placing, dealing in or advising on financial instruments, or managing or marketing collective investment schemes.32

For instance, virtual currency exchange platforms that intend to allow trading of tokens, qualifying as financial instruments, on their platforms would need to be authorised as a multilateral trading facility under the amended Law on the financial sector.33

In conclusion, depending on the exact qualification of the token and on the financial service provided, the following regulations may apply:

  1. Law of 10 July 2005 on prospectuses for securities, as amended;
  2. Law on the financial sector, as amended;
  3. Law of 30 May 2018 on markets in financial instruments, as amended;
  4. Law of 17 December 2010 relating to undertakings for collective investment, as amended;
  5. Law of 12 July 2013 on alternative investment fund managers; and
  6. Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended.

Banking and money transmission

A money remittance business equivalent to a money services business (MSB) in the United States is regulated in Luxembourg by the Law on payment services. Unlike MSBs in the United States, Luxembourg payment institutions are fully regulated.34