CSSF and FCA Signal the Next Phase of Crypto Regulation for Funds and Firms

Two significant regulatory developments in early 2026 mark the continued mainstreaming of crypto-assets within European financial regulation:

• In Luxembourg, the CSSF has updated its FAQ Crypto-Assets – Undertakings for Collective Investment (Version 7, 4 February 2026), aligning its position with MiCAR and materially clarifying the ability of UCITS and AIFs to gain exposure to crypto-assets.
• In the UK, the FCA has outlined its forthcoming full FSMA-based regulatory regime for cryptoassets, replacing the current AML-focused framework with comprehensive authorisation and conduct supervision.

Taken together, these updates demonstrate a consistent policy direction towards greater regulatory integration of crypto-assets into traditional financial frameworks, combined with increased governance, prudential and AML expectations.

Luxembourg: CSSF Update on Crypto-Assets and Investment Funds

The CSSF has formally adopted and updated its terminology to “crypto-assets”, aligning its framework with Regulation (EU) 2023/1114 (MiCAR). This means that crypto-assets are no longer peripheral but treated within the established EU financial architecture.

A notable development is the clarification that UCITS may obtain indirect exposure to crypto-assets, subject to strict conditions. Such exposure is capped at 10% of the fund’s net asset value and must be obtained through eligible transferable securities within the meaning of MiFID that do not embed derivatives. The management company is required to conduct a comprehensive risk assessment, properly document the analysis, and integrate the relevant risks into the fund’s risk management framework. In addition, prior notification to the CSSF is expected before implementing such an investment strategy. While this approach permits limited access to a less established asset class, it is structured in a manner that preserves the core retail protection principles underpinning the UCITS regime. Crucially, a UCITS is still not permitted to obtain direct exposure to crypto-assets.

The CSSF also confirms that AIFs may invest directly or indirectly in crypto-assets falling within the scope of MiCAR. AIFs marketed to retail investors (other than well-informed investors) are subject to a maximum exposure of 10% of net asset value.

Investment Fund Managers must assess carefully whether additional authorisation is required in light of the contemplated level and structure of crypto-asset exposure. Prior CSSF approval for the “Other-Other Fund – Crypto-assets” strategy is required where an AIF’s exposure to crypto-assets exceeds 10% of its net asset value. Where exposure is obtained indirectly through target funds, a crypto-specific licence may not be required; however, a fund-of-funds authorisation may be triggered if the investment in such target funds exceeds 20% of net asset value. Investment Fund Managers should therefore review product structuring and regulatory permissions in advance of launching crypto-focused strategies.

The CSSF also places particular emphasis on operational safeguards. Luxembourg depositaries may act for funds investing in crypto-assets, provided that they implement appropriate organisational arrangements and custody controls tailored to the specific features of such assets. In addition, AML/CFT risk assessments must take into account the increased inherent risks associated with crypto-assets, and compliance and risk officers are expected to demonstrate sufficient expertise and effective mitigation measures. The overall approach reflects a balance whereby increased investment flexibility is accompanied by stringent supervisory expectations in relation to governance, risk management and control functions.

United Kingdom: FCA’s New Cryptoasset Regime under FSMA

The FCA recently published a series of papers on its new Cryptoasset Regime and held a webinar for the market, explaining in more detail that it is moving from the current limited AML registration framework to a comprehensive FSMA-based regulatory regime for cryptoasset activities.

This will bring firms involved in specific crypto-asset activities fully within the UK financial services perimeter, subject to standards comparable to those of traditional financial institutions.

Specifically, the FCA focuses on capturing activities associated with crypto assets and the forthcoming regime will regulate the following activities:

• Operating cryptoasset trading platforms
• Dealing in cryptoassets (principal or agent)
• Arranging deals in cryptoassets
• Safeguarding / custody services
• Issuing qualifying stablecoins

Firms that have not obtained authorisation by the commencement date may be subject to transitional restrictions, which could limit their ability to undertake new UK business. During the webinar, the FCA emphasised the importance of early preparation and the development of a robust business plan. While acknowledging that such plans may evolve, the FCA indicated that priority should be given to establishing the necessary organisational structures and governance frameworks at an early stage in the process.

Authorised firms will be required to comply with a comprehensive set of regulatory standards, including conduct of business requirements, senior management accountability obligations, prudential and capital requirements, operational resilience frameworks, and specific safeguarding and custody rules. In addition, firms will be subject to the Consumer Duty and applicable market integrity obligations. The FCA’s approach makes clear that cryptoasset activities will be integrated into the mainstream financial regulatory framework rather than treated as a standalone or bespoke regime.

The applications are expected to start from 30 September 2026 through to 28 February 2027. The regime is then set to enter into force on 25 October 2027.

Key Themes Across Both Jurisdictions

Although Luxembourg and the UK are proceeding under different legislative frameworks, MiCAR in the EU and FSMA in the UK, the overall policy direction is notably aligned. In both jurisdictions, crypto-assets are being incorporated into existing regulatory architectures rather than treated as exceptional or standalone products. Retail participation remains possible but is subject to clear safeguards, whether through quantitative caps in Luxembourg or the application of a comprehensive conduct regime in the UK. At the same time, governance and AML expectations are intensifying, with both regulators emphasising senior management accountability, operational resilience and robust AML/CFT controls. Authorisation is also becoming the default position: in the UK, crypto firms will transition from AML registration to full financial services authorisation, while in Luxembourg, investment fund managers may require specific strategy approvals depending on the level of crypto-asset exposure.

Conclusion

The regulatory trajectory is no longer about whether crypto-assets will be regulated, but how deeply they will be embedded within mainstream financial supervision.

Luxembourg has opened a carefully controlled pathway for fund exposure to crypto-assets under MiCAR. The UK is preparing to subject crypto firms to full FSMA regulation.

For market participants, the opportunity lies in aligning innovation with sound governance practices before the new regimes take full effect. As crypto-assets become embedded within mainstream financial regulation, early structuring and governance alignment will be critical. For strategic advice on MiCAR, CSSF expectations or the UK’s forthcoming FSMA crypto regime, please contact us.