Cityscape of Luxembourg City. Photo: olrat/iStock
23 Oct 2026, 10:10 am
As interest in tokenised funds in Luxembourg continues to grow, new guidance sheds light on the regulatory and operational requirements firms need to navigate.
Earlier this year tokenisation fund units were hailed as “the next big thing for Luxembourg” by Claude Marx, director general of the Commission de Surveillance du Secteur Financier (CSSF), the government entity responsible for regulating professionals and products in Luxembourg's financial sector.
As reported by the Luxembourg Times, Marx told a fund industry conference in May that fund tokenisation – the process of using distributed ledger technology (DLT) to convert an asset or cashflows, and their ownership rights, to digital form – could make trading of authorised funds quicker, and that blockchain technology could make “quantum leaps” for the sector in terms of both “efficiency and cost.”
On 2 October, CSSF published its first FAQ on tokenisation (9-page/172KB PDF), addressing the industry’s recurring questions surrounding the issuance of tokenised fund units or shares and certain requirements applicable to entities acting as control agents.
The guidance provides welcome confirmation that Luxembourg’s existing legal and regulatory framework can accommodate the native issuance of fund units or shares using DLT, as well as operating models involving different service providers for traditional and tokenised units or shares. However, it states that tokenisation must be integrated into the existing regulatory architecture and does not displace the requirements governing the administration of undertakings for collective investment (UCI).
The design of the operating model, the respective responsibilities of its participants, operational resilience, outsourcing arrangements and the sequencing of regulatory procedures will therefore remain central to any Luxembourg fund tokenisation project.
The CSSF encourages entities considering the tokenisation of funds or the provision of services in relation to tokenised funds to engage with the CSSF at an early stage for a preliminary discussion, with a view to determining the applicable legal and regulatory framework and any relevant licensing requirements.
Below we outline the six main areas that the CSSF addresses in the FAQ concerning the issuance of tokenised fund units or shares and certain requirements applicable to entities acting as control agents.
Applying the principle of technological neutrality, the CSSF confirms that a Luxembourg UCI may issue units or shares natively and exclusively on DLT provided that the proposed operating model complies with the legal and regulatory framework applicable to the relevant UCI.
Tokenised units or shares may be issued in either registered or dematerialised form within the meaning of the Law of 10 August 1915 on commercial companies, as amended.
The CSSF clarifies that the use of DLT, whether for issuance or record-keeping infrastructure, does not in and of itself determine whether the units or shares are issued in registered or dematerialised form. The assessment of the legal form of the units or shares must therefore be conducted independently of the underlying technology used.
The CSSF also confirms that a UCI administrator performing the registrar function may maintain the unitholder or shareholder register on DLT. Where units or shares are issued in dematerialised form, a UCI administrator as defined in CSSF Circular 22/811 (38-page / 464KB PDF) must continue to perform the registrar function. The requirements applicable to dematerialised securities under the relevant legislation must also be complied with.
Any UCI administrator proposing substantial DLT-related changes to the operating model described in its initial authorisation application must obtain the CSSF's prior approval for those changes.
The principal practical takeaway is that Luxembourg UCIs may issue units or shares natively on DLT. However, the use of DLT does not remove the need to determine the legal form of the relevant units or shares nor compliance with the UCI administration, registrar and securities law requirements applicable to that form.
The appointment of a control agent under the Law on Dematerialised Securities (8-page / 160KB PDF) does not remove the requirement for an eligible UCI administrator to perform the registrar function under CSSF Circular 22/811.
The CSSF explains that the registrar tasks listed in points (19) and (20) of CSSF Circular 22/811 extend beyond the duties assigned to a control agent under article 1(10a)(a) to (c)2 of the Law on Dematerialised Securities. A UCI administrator must therefore perform the remaining registrar tasks.
The two functions – UCI administrator and control agent – may nevertheless be performed by the same entity, provided that it holds the necessary authorisation to act as a UCI administrator and has notified its intention to operate as a control agent.
The CSSF clarifies that the control agent and registrar functions are legally distinct, even where they are operationally combined within the same appropriately authorised entity. This distinction should be reflected in the operating model and contractual allocation of responsibilities.
A UCI issuing both traditional and tokenised units or shares may appoint different UCI administrators to perform elements of the registrar function, subject to certain requirements and compliance with CSSF Circular 22/811.
These requirements include no fragmentation of tasks preventing the general supervisory function; transparency towards investors; at least one of the involved entities is required to maintain a consolidated view of all units or shares issued by the UCI; appropriate management of additional risk resulting from the division of responsibilities; and full compliance with applicable laws. This includes the legal requirement to maintain the register at the registered office and the legally required content of register.
The CSSF clarifies that hybrid models are permissible, but not at the expense of effective supervision, consolidated record-keeping or clear investor disclosure. Accordingly, the interfaces between the relevant service providers and the allocation of responsibilities among them should be carefully reflected in the operational framework and contractual arrangements.
An eligible entity intending to act as a control agent must first present its proposed operating model to the CSSF and then notify the regulator at least two months before commencing the activity. The notification must contain the information necessary for the CSSF to verify compliance with the conditions set out in the Law on Dematerialised Securities.
Importantly, the CSSF clarifies that the two-month period only starts once it confirms that the notification is complete. The CSSF may request additional information and may prohibit an entity from commencing or continuing the control agent activity if the notification is insufficient or the applicable legal requirements are not met.
Where part of the proposed activity is outsourced or supported by an ICT third-party arrangement, separate notifications may be required under CSSF Circular 22/806 on outsourcing arrangements (46-page / 667KB PDF) or CSSF Circular 25/882, as amended by CSSF Circular 26/915 (11-page / 265KB PDF), on the use of ICT third-party services by financial entities subject to the EU’s Digital Operational Resilience Act (DORA).
The guidance indicates that the relevant notification must generally be submitted at least three months before the outsourcing begins, reduced to one month where the outsourcing is to a Luxembourg support professional of the financial sector (PFS). These different periods may affect the timing of the control-agent notification and must therefore be coordinated from the outset.
For an entity established elsewhere in the European Economic Area (EEA), the FAQ also clarifies that the CSSF must be competent to verify compliance with the requirements applicable to control agents under the Law on Dematerialised Securities.
The entity must first inform its home competent authority and ensure that the necessary supervisory cooperation is available to enable the CSSF to verify compliance with relevant requirements.
The key clarification is that the control-agent regime operates as a prior notification rather than a stand-alone licence application, but the statutory two-month period does not begin automatically upon filing. It begins only once the CSSF confirms that the file is complete, and related regulatory notifications may affect the overall timeline.
DORA requirements apply to a control agent. Consequently, the relevant entity is required to demonstrate that its information-processing systems and the related control and security arrangements are suitable for the performance of the control agent function. Its existing DORA compliance framework must therefore expressly extend to that activity.
The clarification is significant because DORA is not applied solely to the technology provider or DLT infrastructure. The eligible entity acting as control agent must itself integrate the control agent activity into its ICT risk management, governance, control and security framework.
A control agent may use a third-party service provider for technical support in connection with the tokenisation of UCIs, including for development or for administration of smart contracts.
However, the CSSF considers it highly likely that the control agent activity constitutes a critical or important function under the DORA framework. Where an ICT third-party arrangement supports that function, the control agent must notify the CSSF using the form applicable to an ICT third-party arrangement supporting a critical or important function, within the applicable timeframe.
Where an applicant concludes in its own assessment that the control agent activity is not a critical or important function, it must raise that conclusion when presenting its operating model to the CSSF, before submitting the formal notification, and provide a robust supporting rationale.
The clarification is therefore not merely that technical outsourcing is permitted. It is that the control agent remains subject to the DORA framework and that arrangements with DLT, smart contract or other ICT providers will generally need to be treated as supporting a critical or important function, unless a different conclusion can be robustly substantiated to the CSSF.
CSSF’s guidance provides helpful clarification for the sector and moves Luxembourg another step forward to making fund tokenisation a reality.
Firms interested in tokenisation projects should seek legal advice on navigating the preliminary CSSF dialogue and applicable regulatory procedures, as well as structuring fund tokenisation operating models.
Written by
