Key Takeaways
- • The CSSF published Version 7 of its crypto-asset FAQ on 4 February 2026, a full revision that updates every question and replaces "virtual assets" with "crypto-assets" as defined in article 3(1)(5) of MiCAR.
- • UCITS remain barred from direct crypto-asset investment, but indirect exposure via transferable securities without embedded derivatives is still capped at 10% of NAV, now expressly anchored in MiCAR with prior CSSF notification required.
- • AIFs may invest directly in crypto-assets, with prior CSSF authorisation now required only where exposure exceeds 10% of NAV, and AIF investments now fall explicitly under MiCAR.
- • Depositaries face the most significant change: a two-model framework, with new advance CSSF notification obligations for any depositary acting for a fund investing directly in crypto-assets.
- • IFMs must now analyse their crypto-related services against article 60(5) of MiCAR and compute ML/TF risk scores per crypto-asset investment under CSSF Regulation 12-02.
Summary
Luxembourg's financial sector regulator, the Commission de Surveillance du Secteur Financier (CSSF), has published Version 7 of its FAQ on crypto-assets in investment funds, a root-and-branch revision of the document first issued in January 2022. According to K&L Gates' analysis, the update is driven largely by the EU Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCAR), which now provides an EU-wide framework for crypto-assets. The most visible change is terminological, but the revision signals a move from an ad hoc national approach to one grounded in harmonised EU law.
For UCITS, the core position is unchanged: direct investment in crypto-assets remains prohibited, while indirect exposure through transferable securities without embedded derivatives remains permitted up to 10% of net asset value. The 2026 FAQ now explicitly requires prior CSSF notification, a case-by-case risk assessment with adequate internal controls, and investor disclosure. Securities that qualify as financial instruments under the Luxembourg law of 5 April 1993 are excluded from MiCAR and are not restricted under the FAQ when used to gain crypto-sector exposure.
For alternative investment funds, direct crypto investment remains permitted, with a 10% NAV cap for retail-accessible funds. AIF investments are now expressly placed under the scope of MiCAR, though no specific prior notification requirement has been introduced. Luxembourg IFMs previously needed prior CSSF authorisation under the "Other-Other Fund-Crypto-assets" strategy; that requirement now applies only where crypto exposure exceeds 10% of NAV. IFMs must also analyse their crypto-related services against article 60(5) of MiCAR, which may trigger additional authorisation or notification obligations. Fund-of-funds managers are not required to hold the crypto licence but must assess target managers' crypto risk capabilities and produce those assessments on CSSF request.
The depositary framework has changed most substantially. The 2026 FAQ replaces the general 2022 position with two models. Where the depositary does not provide MiCAR custody, a specialised crypto-asset service provider is appointed directly by the fund or manager and bears restitution liability. Where the depositary does provide custody, it must obtain authorisation under article 62 of MiCAR or use the notification route under article 60, and the crypto-assets are recognised on its balance sheet. Depositaries must now notify the CSSF in advance before acting for funds investing directly in crypto-assets, and separately inform the CSSF of any plan to safeguard such assets directly.
On AML/CFT, the underlying position is unchanged: crypto investment elevates money laundering, terrorist financing and proliferation financing risks. The new element is operational, grounded in article 34 of CSSF Regulation 12-02, requiring IFMs to compute ML/TF risk scores for each crypto-asset investment and calibrate due diligence accordingly. K&L Gates recommends that managers review fund documentation for MiCAR compliance and revisit depositary and AML arrangements in light of the February 2026 update.
For UCITS, the core position is unchanged: direct investment in crypto-assets remains prohibited, while indirect exposure through transferable securities without embedded derivatives remains permitted up to 10% of net asset value. The 2026 FAQ now explicitly requires prior CSSF notification, a case-by-case risk assessment with adequate internal controls, and investor disclosure. Securities that qualify as financial instruments under the Luxembourg law of 5 April 1993 are excluded from MiCAR and are not restricted under the FAQ when used to gain crypto-sector exposure.
For alternative investment funds, direct crypto investment remains permitted, with a 10% NAV cap for retail-accessible funds. AIF investments are now expressly placed under the scope of MiCAR, though no specific prior notification requirement has been introduced. Luxembourg IFMs previously needed prior CSSF authorisation under the "Other-Other Fund-Crypto-assets" strategy; that requirement now applies only where crypto exposure exceeds 10% of NAV. IFMs must also analyse their crypto-related services against article 60(5) of MiCAR, which may trigger additional authorisation or notification obligations. Fund-of-funds managers are not required to hold the crypto licence but must assess target managers' crypto risk capabilities and produce those assessments on CSSF request.
The depositary framework has changed most substantially. The 2026 FAQ replaces the general 2022 position with two models. Where the depositary does not provide MiCAR custody, a specialised crypto-asset service provider is appointed directly by the fund or manager and bears restitution liability. Where the depositary does provide custody, it must obtain authorisation under article 62 of MiCAR or use the notification route under article 60, and the crypto-assets are recognised on its balance sheet. Depositaries must now notify the CSSF in advance before acting for funds investing directly in crypto-assets, and separately inform the CSSF of any plan to safeguard such assets directly.
On AML/CFT, the underlying position is unchanged: crypto investment elevates money laundering, terrorist financing and proliferation financing risks. The new element is operational, grounded in article 34 of CSSF Regulation 12-02, requiring IFMs to compute ML/TF risk scores for each crypto-asset investment and calibrate due diligence accordingly. K&L Gates recommends that managers review fund documentation for MiCAR compliance and revisit depositary and AML arrangements in light of the February 2026 update.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.