What does the new CSSF FAQ mean for tokenised fund structures in Luxembourg?

The Commission de Surveillance du Financier published an FAQ on tokenisation on 2 October 2026, highlighting important considerations for fund sponsors, investment fund managers, UCI administrators, prospective control agents and technology providers.

The FAQ contains six questions and answers covering:

• the issuance of tokenised units / shares by Luxembourg undertakings for collective investment (UCIs)

• the control agent introduced into dematerialised securities (the Dematerialised Securities Law[1]), as amended

The FAQ is not exhaustive, is without prejudice to other obligations (including anti-money laundering (AML) obligations) and will be updated as new questions arise.

Are tokenised fund units crypto-assets under MiCAR?

The FAQ addresses only the tokenisation of Luxembourg funds through the issuance of their units / shares as registered or dematerialised securities. These are securities within the meaning of Luxembourg law (the Companies Law on commercial companies[2] and the Dematerialised Securities Law) and EU securities legislation (in particular, Directive 2014/65/EU on markets in financial instruments (MiFID II)).

Tokenised fund units / shares remain units in collective investment undertakings and are therefore financial instruments. Using distributed ledger technology (DLT) changes the issuance and record-keeping infrastructure, not the legal nature of the units.

For this reason, tokenised fund units / shares fall outside the scope of the Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCAR), which excludes crypto-assets that qualify as financial instruments. They remain subject to the applicable fund, securities and financial sector rules (including the 2010 Law[3], the AIFM Law[4], Circular CSSF 22/811, MiFID II and anti-money laundering / counter-terrorist financing rules), and not to MiCAR’s white paper, issuer or crypto asset service provider (CASP) regimes.

How do Luxembourg’s blockchain laws fit together?

The FAQ builds on a step-by-step legislative framework that has expressly recognised the use of DLT for securities:

• Blockchain Law I (Law of 1 March 2019) amended the Law of 1 August 2001 on the circulation of securities so that account keepers may hold securities accounts and record securities through secure electronic recording mechanisms, including DLT

• Blockchain Law II (Law of 22 January 2021) amended the Dematerialised Securities Law and the Financial Sector Law[5] on the financial sector to allow issuance accounts for dematerialised securities to be kept on secure electronic recording mechanisms, including DLT

• Blockchain Law III (Law of 15 March 2023) implemented the EU DLT Pilot Regime (Regulation (EU) 2022/858) and confirmed that DLT may be used for financial collateral and that DLT-issued instruments are financial instruments

• Blockchain Law IV (Law of 20 December 2024) amended the Dematerialised Securities Law, the Financial Sector Law and the CSSF Law[6] to introduce the possibility of appointing a control agent for securities issuance

What is the distinction between fund units and fund assets?

The new FAQ concerns the liability side of funds, meaning the issuance and registration of tokenised fund units / shares. It should be read separately from the Commission de Surveillance du Financier's(CSSF) existing positions on fund assets. Those positions are set out in the CSSF FAQ Crypto-Assets – Undertakings for collective investment (Version 8, 24 April 2026), which applies only to crypto-assets held in fund portfolios.

In summary: 

• undertakings for collective investment in transferable securities (UCITS) may invest only indirectly in crypto-assets up to 10% of net asset value (NAV), through transferable securities that do not embed derivatives

• alternative investment funds (AIFs) may invest directly and indirectly in crypto-assets within MiCAR’s scope, while AIFs open to retail investors (other than well-informed investors) are limited to 10% of NAV

• alternative investment fund managers (AIFMs) managing AIFs that invest more than 10% of NAV in crypto-assets need prior CSSF authorisation for the “Other-Other Fund-Crypto-assets” strategy, but no such licence is needed for investment through target funds - although a fund-of-funds authorisation applies above 20% of NAV

• depositaries must notify the CSSF in advance before acting for funds investing directly in crypto-assets. Custody by the depositary itself requires MiCAR CASP authorisation or notification

These asset-side rules do not govern the tokenisation of the fund’s own units / shares, which is the subject of the new FAQ.

Key positions in the FAQ

Q1 – Native tokenised units are permitted

• Luxembourg UCIs may issue units / shares natively on DLT, provided the operating model complies with the framework applicable to the UCI (technological neutrality)

• tokenised units / shares may be registered or dematerialised under the Companies Law. DLT does not determine the legal form, and the legal form does not determine the infrastructure

• registered units: a UCIA performing the registrar function may keep the unit / shareholder register on DLT

• dematerialised units: an eligible entity (IFM, registrar agent or credit institution authorised as UCIA) must act as registrar UCIA, and the Dematerialised Securities Law applies in full

• substantial changes to a UCIA’s operating model to use DLT require CSSF authorisation (point (5), Circular CSSF 22/811)

Q2 – A control agent does not replace the registrar

• the legal form of the units does not affect the obligation to appoint a registrar UCIA under Circular CSSF 22/811

• registrar tasks (points (19)–(20) of the Circular) go beyond the control agent’s tasks (Article 1(10a)(a)–(c) of the Dematerialised Securities Law), so the residual tasks stay with the UCIA

• one entity holding all required licences may perform both roles, for example a credit institution authorised as UCIA that has notified as control agent under Article 21a of the Dematerialised Securities Law

Q3 – Multiple registrar UCIAs for hybrid funds

• permitted where a UCI issues both tokenised and traditional units / shares, subject to five conditions:

1. no fragmentation impairing coordination and supervision, and no unjustified cost or complexity

2. disclosure of the operating model and its risks, naming every UCIA and its function in the offering documents (point (41) of Circular CSSF 22/811)

3. one entity keeping a consolidated view of all units for NAV, distributions and capital calls

4. management of the additional risks by the IFM / UCI

5. full legal compliance, including the register of registered shares at the registered office

Q4 – Becoming a control agent

• present the operating model to the CSSF first, then notify at least two months before starting (Article 21a(2) of the Dematerialised Securities Law)

• the period runs only from the CSSF’s confirmation that the notification is complete. Absent prohibition, the activity may then start

• the CSSF may prohibit the activity if the information is insufficient or the requirements of Article 21a of the Dematerialised Securities Law are, or cease to be, unmet

• outsourcing or information and communication technology (ICT) notifications (three months ahead, or one month for a Luxembourg support professional of the financial sector (PFS)) under Circulars CSSF 22/806 and 25/882 may extend timelines

• European Economic Area (EEA) entities must inform their home regulator first, pass on its comments, and ensure it will cooperate with the CSSF. These are completeness conditions

Q5–Q6 – The Digital Operational Resilience Act (DORA) and third-party providers

• entities eligible as control agents are in DORA scope (Article 2(1)(a), (e), (g) of DORA). Relying on Joint European Supervisory Authority (ESA) Q&As 136-3193 and 137-3195, the CSSF applies DORA to the control agent activity, which must be covered by the entity’s DORA framework.

• third-party technical support (for example, smart contract development or administration) is allowed. The activity is highly likely a critical or important function, so a Circular CSSF 25/882 notification is required unless a robust contrary rationale is given upfront.

Practical takeaways

Fund sponsors and IFMs

• decide early whether tokenised classes will be registered or dematerialised. Dematerialised units require compliance with the Dematerialised Securities Law and, where used, a control agent alongside the registrar UCIA (Q1–Q2)

• prepare the preliminary CSSF presentation: the full token lifecycle (issuance, trading, settlement, distribution), the legal qualification of the tokens and rights attached, all stakeholders, and contractual and outsourcing arrangements

• for hybrid funds, designate the entity holding the consolidated view of all units for NAV, distributions and capital calls, and update risk management for the split registrar model (Q3)

• update offering documents to name every UCIA and its function and to disclose the operating model and its risks (Q3; point (41) of Circular CSSF 22/811)

UCI administrators

• assess whether moving the register to DLT is a substantial change to the operating model requiring prior CSSF authorisation under point (5) of Circular CSSF 22/811 (Q1)

• where acting alongside a control agent, map the residual registrar tasks under points (19) and (20) of Circular CSSF 22/811 that remain with the UCIA (Q2)

• in multi-registrar set-ups, agree a clear allocation of tasks that avoids fragmentation, duplication and unnecessary cost (Q3)

Prospective control agents

• build a timetable around the two-month notification period, which starts only on CSSF confirmation of completeness (Q4)

• file outsourcing or ICT third-party notifications in parallel, at least three months ahead (one month for a Luxembourg support PFS) (Q4, Q6)

• EEA entities: inform the home regulator first, report its comments to the CSSF and confirm cooperation arrangements, as these are completeness conditions (Q4)

• extend the DORA framework to the control agent activity and treat it, by default, as a critical or important function. Any contrary self-assessment must be justified upfront (Q5–Q6)

Technology providers

• expect DORA-compliant contractual terms for critical or important functions when supporting control agents, for example smart contract development and administration (Q6)

How Ogier can help

Ogier’s Luxembourg investment funds and regulatory team advises sponsors, managers and service providers on tokenised fund structures, CSSF engagement and DORA and outsourcing notifications.

¹the Law of 6 April 2013 on dematerialised securities, as amended [back to top]

²the Law of 10 August 1915 on commercial companies, as amended [back to top]

³the Law of 17 December 2010 relating to undertakings for collective investment, as amended [back to top]

⁴the Law of 12 July 2013 on alternative investment fund managers, as amended [back to top]

⁵the Law of 5 April 1993 on the financial sector, as amended [back to top]

⁶the Law of 23 December 1998 establishing a financial sector supervisory commission (Commission de Surveillance du Secteur Financier), as amended [back to top]

About Ogier

Ogier is a professional services firm with the knowledge and expertise to handle the most demanding and complex transactions and provide expert, efficient and cost-effective services to all our clients. We regularly win awards for the quality of our client service, our work and our people.

Disclaimer

This client briefing has been prepared for clients and professional associates of Ogier. The information and expressions of opinion which it contains are not intended to be a comprehensive study or to provide legal advice and should not be treated as a substitute for specific advice concerning individual situations.

Regulatory information can be found under Legal Notice