Luxembourg Flags Crypto Firms High Risk for Money Laundering

Luxembourg has classified virtual asset service providers (VASPs) as high-risk entities for money laundering in its 2025 National Risk Assessment (NRA), highlighting concerns over the crypto industry’s exposure to financial crime. The inherent risk level of VASPs is deemed “High,” driven by factors including transaction volume, client reach, distribution channels, legal structures, and the international scope of operations. This designation follows a detailed assessment of money laundering (ML) inherent risks emerging from virtual assets, which was first identified in the 2020 NRA report. The 2022 NRA report further emphasized the risks associated with crypto assets and virtual currencies, noting their internet-based and cross-border nature.

The EU, of which Luxembourg is a founding member, has been working to regulate the cryptocurrency industry. A key part of this effort is the Markets in Crypto-Assets (MiCA) framework, designed to unify crypto regulation across all 27 EU member states. Since January, crypto asset service providers have started acquiring licenses to operate legally within the EU. This includes cryptocurrency exchange Kraken launching regulated derivatives trading and competitor Crypto.com securing a license allowing it to do the same. MiCA also establishes a new set of requirements for stablecoins. The stablecoin market leader behind USDt (USDT), Tether, refuses to comply with the new rules and was delisted on Crypto.com, Coinbase, and leading crypto exchange Binance on their EU platforms.

As the role of cryptocurrencies in the broader financial ecosystem increases, so does their popularity for money laundering. Earlier this month, police arrested 12 people involved in a cross-border money laundering scheme that relied on crypto and over 500 stooge bank accounts to launder 118 million Hong Kong dollars. European law enforcement arrested 17 suspects of a “mafia crypto bank” for allegedly laundering over 21 million euros in crypto for Middle East and China-based criminal entities. As a result of the proceedings, 4.5 million euros worth of items were seized, including cash, crypto, 18 vehicles, four shotguns, and several electronic devices.

Luxembourg's decision to flag crypto companies as high risk is part of a broader trend of increased regulatory scrutiny on the digital asset industry. As cryptocurrencies continue to gain mainstream acceptance, governments and financial regulators around the world are taking steps to ensure that these assets are not used for illicit purposes. The FIAU's guidance is a significant step in this direction, providing a framework for identifying and reporting suspicious activities related to cryptocurrency companies. The implications of this designation are significant for the cryptocurrency industry. Companies operating in this space will need to implement robust AML and CTF measures to comply with regulatory requirements and mitigate the risk of being flagged as high risk. This may include enhanced due diligence procedures, increased monitoring of transactions, and greater transparency in corporate records. Failure to comply with these measures could result in severe penalties, including fines and the loss of operating licenses.

In conclusion, Luxembourg's decision to flag cryptocurrency companies as high risk for money laundering is a significant development in the ongoing effort to combat financial crime. The FIAU's guidance provides a valuable framework for identifying and reporting suspicious activities, and companies operating in the cryptocurrency space will need to take proactive steps to ensure compliance with regulatory requirements. As the digital asset industry continues to evolve, it is likely that we will see further regulatory developments aimed at enhancing AML and CTF measures.