Luxembourg has enacted a new law requiring Crypto-Asset Service Providers to report transactions involving EU-resident users from 1 January 2026. The rules cover authorised CASPs, local branches, and companies with a Luxembourg connection, and aim to strengthen tax transparency and anti-money laundering efforts.
Luxembourg has enacted a new law implementing EU Directive 2023/2226 (DAC8) on 27 March 2026, setting out reporting requirements for Crypto-Asset Service Providers (CASPs).
The rules take effect from 1 January 2026 and apply to both authorised CASPs under the EU Markets in Crypto-Assets (MiCA) Regulation and providers with a Luxembourg connection, including local branches or companies with tax residency or management in the country.
Under the law, CASPs must register with the Luxembourg tax authorities (ACD) and submit annual reports by 30 June each year, starting with the 2026 calendar year. Providers must collect information from users through self-certification, block those who fail to provide the required data, and retain records for 10 years. Even if a CASP has no reportable users, it must submit a “zero report.”
The legislation also covers the automatic exchange of information for income from life insurance products and certain advance cross-border tax rulings. Reported data may be used to support anti-money laundering measures, counter-terrorism financing, and Luxembourg customs enforcement. Lawyers acting as intermediaries under DAC6 must notify their own clients but no longer have to inform other intermediaries.
Non-compliance carries financial penalties ranging from EUR 5,000 for registration or reporting errors to EUR 250,000 for serious breaches, and repeated failures can result in revocation of CASP registration.
