Financial services providers that are authorized in another EEA member state may carry on their activities and provide their services in Luxembourg through the establishment of a branch, provided that their activities are covered by their authorization. They may provide ancillary services in Luxembourg only if offered together with their core service activity. The exercise of their activities is not subject to any additional authorization by the Luxembourg authorities.

Credit institutions, investment firms, electronic money institutions and payment service providers that are not established in another EEA member state (“Third Country Firms”) and any PFS other than investment firms, whether established inside or outside the EEA, wishing to establish a branch in Luxembourg shall be subject to the same authorization rules as those applying to financial services providers governed by Luxembourg law.

Where a firm outside of Luxembourg has a client or a counterparty domiciled in Luxembourg, this does not mean that it performs ipso facto regulated activities within the Luxembourg territory. Whether those activities trigger a local licensing obligation will depend on the specific activities and physical travel of agents to Luxembourg. Activities such as simple canvassing of clients or the advertising and organization of a “road show” are exempted from the need for a Luxembourg license. The same applies to mere introductory visits to Luxembourg-based clients. However, if agents of Third Country Firms travel occasionally and temporarily to Luxembourg, notably to collect deposits or other payable funds from the public and to provide any other financial service that is covered by the Law on the Financial Sector, local authorization would be required.

By way of example, the following activities are regarded as being carried on outside of Luxembourg and therefore not subject to Luxembourg regulation:

• The activity of accepting deposits is regarded as being carried out where deposit funds are accepted. Where a Luxembourg resident credits funds to a bank account held outside Luxembourg, the foreign bank where the individual holds his account will not be regarded as accepting deposits in Luxembourg. A Third Country bank or a non-passported EEA bank can therefore hold an account for a Luxembourg resident without contravening Luxembourg laws.
• Direct insurance activities would generally be considered as having been conducted in Luxembourg if the solicitation of Luxembourg resident policyholders and the conclusion and execution of the insurance contract took place in Luxembourg. However, a Third Country insurance undertaking is not deemed to be performing insurance activities in Luxembourg when the policyholder took the initiative to enter into the contract without having been contacted by the insurance undertaking beforehand.

In other cases, the activities might be deemed to be carried out in Luxembourg and subject to Luxembourg laws. For example, advice is regarded as being given where the recipient of the advice is located, so that where a foreign firm is advising a client in Luxembourg, the firm will be regarded as carrying out the activity of advising in Luxembourg. The same analysis applies in relation to the activity of dealing, so that where a counterparty to a transaction is located in Luxembourg, the activity of dealing will be regarded as being carried out in Luxembourg.

An exclusion to this could apply if the Luxembourg client approached the financial service provider in their home country solely upon their own initiative and without having been previously solicited by the service provider (i.e., reverse solicitation).

Recent EU legislation and developments that will have an impact on doing business in Luxembourg in particular are as follows:

• Brexit – The EU-UK Trade and Cooperation Agreement (TCA), applicable from 1 January 2021, does not provide a substitute for the EU market access that was available to UK firms through passporting rights prior to the end of the Brexit transition period (and which were terminated when the UK departed the EU). In order to access the single market, UK-based financial services firms now have to either comply with the regulatory requirements for market access set at the level of individual member states or rely on the possibility of equivalence decisions that, even if concluded, will not cover the same range of financial activities as passporting and can be unilaterally revoked.
• AIFMD II (the revised Alternative Investment Fund Managers Directive) –The initial directive on Alternative Investment Fund Managers adopted in 2010 was been amended on 26 March 2024. EU member states have two years from the directive's entry into force to transpose it within their national law. The revised text provides for additional professional obligations for the managers of alternative investment funds that are within its scope.
• MiFID II (comprising a recast of the Markets in Financial Instruments Directive and a European regulation) – MIFID II harmonizes the ability of Third Country Firms to access the EU market. Under the MIFID II regime, Third Country Firms are able to apply to ESMA for status as permitted Third Country Firm, which allows them to provide investment services or perform activities directly to specific counterparties and clients (excluding retail clients) across the EU without first establishing a branch.
• IDD (the Insurance Distribution Directive, recasting the Insurance Mediation Directive) – The IDD extends the supervisory control to all distribution channels of (re)insurance contracts, including direct sales by (re)insurance undertakings, ancillary insurance intermediaries, and certain activities by insurance aggregator or price and product comparison websites. At the same time, the IDD contains important new or slightly reworded carve-outs excluding certain activities from regulation.

In Luxembourg, cryptoassets are referred to as virtual assets and are regularly the object of guidance published by the Commission de Surveillance du Secteur Financier. As mentioned above in question 3, virtual asset service providers have to register with the CSSF and comply with the requirements of the AML Law. In addition, alternative investment fund managers that carry out mandate in respect of funds investing in cryptoassets need to request an authorization within the context of their AIFM license.

With the adoption of the Regulation on Markets in Cryptoassets (MICAR) at the European level, there is a harmonized framework for the issuance, offer to the public, admission to trading, and provision of services related to certain cryptoassets in the European Union, being the asset-referenced token (ART), e-money token (EMT) and other cryptoassets that do not qualify as financial instruments. The CSSF is the supervisory authority that shall deliver the authorization to cryptoasset service providers, bearing in mind that certain of these entities may already have a regulated status (e.g., credit institutions, investment firms) and may provide services upon a simple notification.

The types of services that fall under the scope of MiCAR are as follows:

• Custody and administration of cryptoassets on behalf of clients
• Operation of a trading platform for cryptoassets
• Exchange of cryptoassets for funds
• Exchange of cryptoassets for other crypto-assets
• Execution of orders for cryptoassets on behalf of clients
• Placement of cryptoassets
• Reception and transmission of orders for cryptoassets on behalf of clients
• Provision of advice on cryptoassets
• Portfolio management on cryptoassets
• Transfer services for crypto-assets on behalf of clients

MiCAR entered into force on 29 June 2023 and will apply as follows:

• On 30 June 2024 (12 months after its entry into force) regarding the provisions of Titles III and IV of the regulation relating to the authorization and supervision of ARTs/EMTs
• On 30 December 2024 (18 months after its entry into force) the rest of the provisions provided for by the regulation, in particular on CASPs