Executive summary

On 24 July 2025, the Luxembourg Government published Draft Law 8592 (Draft Law), introducing national provisions to transpose European Union's (EU) Directive 2023/2226 of 17 October 2023 (DAC8) into Luxembourg tax law.

In addition to introducing specific registration, due diligence and reporting duties on Crypto-Asset Service Providers and Crypto-Asset Operators, the Draft Law expands the automatic and mandatory exchange of information on income derived from life insurance products and on certain advance cross-border rulings granted to individuals. To strengthen the fight against money laundering and the financing of terrorism, as well as for the establishment, administration and enforcement of Luxembourg custom duties, the Draft Law also broadens the allowed areas of use of exchanged tax information. Finally, the Draft Law would amend the domestic legislation on reportable cross-border arrangements (DAC6 Law),¹ exchange of information reported by platform operators (DAC7 Law),² the Common Reporting Standard (CRS Law)³ and Country-by-Country Reporting (CbCR Law)⁴ in line with the requirements of DAC8.

The Draft Law would take effect from 1 January 2026.

Detailed discussion

Automatic, mandatory exchange of information declared by Crypto-Asset Service Providers

Scope

The Draft Law defines the registration, due diligence procedures and reporting obligations in Luxembourg for Reporting Crypto-Asset Service Providers (RCASPs) and determines the modalities of the automatic exchange of reported information on crypto assets.

RCASPs are either entities authorized in Luxembourg under the European Union's (EU's) Markets in Crypto-Assets Regulation (MiCAR) or entities that provide Crypto-Asset Services under MiCAR but are not required to register for MiCAR (Crypto-Asset Operators), if they have Luxembourg nexus as a result of elements such as tax residence, company incorporation, usual place of business or place of management.

The scope of new reporting covers crypto-asset service activities such as the (1) management of crypto-asset portfolios, (2) custody and administration of crypto-assets on behalf of third parties, (3) operation of crypto-asset exchange platforms, (4) exchange of crypto-assets for funds or other crypto-assets or (5) execution of orders on behalf of clients. Though the definition of crypto-assets aligns with MiCAR, it is nevertheless broader, as it encompasses all types of crypto-assets that may be used for payment or investment purposes. RCAPs therefore must assess on a case-by-case basis whether the crypto-assets concerned fall within the scope of the Draft Law based on the payment or investment criterion.

Registration requirements

Reporting Crypto-Asset Operators must register with Luxembourg Tax Authorities before the deadline for communicating the information to be reported, which is set at 30 June of each year for information relating to the previous year.

Reporting Crypto-Asset Service Providers authorized under MiCAR do not need to actively register, as the supervisory authority of the Luxembourg financial sector (Commission de surveillance du secteur financier, CSSF) will communicate their identity to the Luxembourg Tax Authorities before 31 March of each year.

Due diligence procedures

The Draft Law requires RCASPs to collect and verify the information on crypto-asset users in line with reasonable due diligence procedures. These requirements include the obligation for RCASPs to determine, through a self-certification of the crypto-asset user (which must meet certain requirements) to be obtained from them, if users are reportable crypto-asset users.

Reporting obligations

By 30 June of each year, RCASPs must report information in relation to the previous calendar year to the Luxembourg Tax Authorities. Information to be reported includes information on the RCASP itself, the reportable users and transactional information on reportable crypto assets.

Exchange of information

The Luxembourg Tax Authorities will then share the locally reported information with tax authorities of the users' residence by 30 September of the calendar year following the year to which the information relates. The first reporting will cover calendar year 2026 with a first exchange to take place by 30 September 2027.

Exemptions

To help prevent double reporting, the Draft Law provides an exemption from due diligence and reporting obligations if, subject to certain conditions, the RCASP fulfills DAC 8 obligations in another EU Member State or a jurisdiction with which Luxembourg has concluded an agreement on the exchange of information similar to DAC8. If an RCASP also qualifies as Financial Institution within the meaning of the CRS Law, it may rely on the due diligence procedures implemented under that law to meet its due diligence obligations under DAC8.

Penalties

A €5,000 penalty would apply for failure by a Crypto-Asset Operator to register in Luxembourg and for failure by an RCASP to report the required information within the legal deadline. Furthermore, Tax Authorities may impose a penalty of up to €250k if it appears, following a control, that an RCASP did not meet its due diligence and reporting obligations.

Exchange of information on life insurance income

The Draft Law introduces automatic exchange of information on income derived from certain life insurance products paid to beneficiaries resident in other EU Member States. This reporting obligation is incumbent on insurance companies established in Luxembourg and is triggered upon the payment of the life insurance contract benefits, to the extent not already reported under the CRS Law. The reporting obligation would apply to insurance benefits paid in taxable periods beginning on or after 1 January 2026.

Exchange of information on advance cross-border rulings

The Draft Law expands the automatic exchange of information to advance cross-border rulings on individuals issued, amended or renewed from 1 January 2026, if either:

• The transactions covered by the cross-border ruling exceed €1.5m (or the equivalent in another currency).
• The tax ruling determines whether the individual is a tax resident under domestic law.

Starting from tax periods beginning on or after 1 January 2028, the Draft Law also requires additional details to be exchanged for advance cross-border rulings and advance pricing agreements that are subject to exchange of information. Specifically, the tax identification number (TIN) issued by the EU Member State(s) of residence of all the relevant parties must be provided.

Amendments to the CRS Law

Central Bank Digital Currency (CBDC), Electronic Money, Electronic Money Tokens or any crypto asset that an RCASP has determined cannot be used for payment or investment purposes should be reportable under CRS.

The Draft Law therefore expands the CRS Law to capture electronic money instruments and central bank digital currency instruments to ensure these financial products are still subject to regulatory oversight and reporting obligations.

Other amendments

The Draft Law also amends:

• The DAC6 Law to reflect the Court of Justice of the European Union's (CJEU) judgment in case C-694/20, dated 8 December 2022: Lawyers bound by professional privilege are no longer required to notify other intermediaries, but must still inform their own clients; other intermediaries retain notification duties
• The DAC7 Law (Platform reporting) to reduce the reporting burden if Platform Operators rely on a confirmed seller's identity and tax residence through identification services
• The CbCR Law to require that information on Constituent Entities includes TINs, if available

Expansion of allowed use of exchanged tax information

The Draft Law extends the allowed use of information exchanged under DAC beyond Luxembourg direct taxes, by specifically allowing this information to be used for the assessment, administration and enforcement of Luxembourg Value Added Tax (VAT), other indirect taxes, customs duties, anti-money-laundering measures and provisions to help counter the financing of terrorism.

Timing

If enacted into law, the proposed provisions would apply from 1 January 2026, with first crypto-asset reporting and exchanges expected in June and September 2027, respectively.

Next steps and implications

The Draft Law will now go through the legislative process, which involves the analysis of the text by a dedicated parliamentary commission, the collection of opinions from different advisory bodies (most importantly, the Council of State), discussion of and vote on the text in a parliamentary session and finally its publication in the Official Gazette (Memorial).

Affected stakeholders should initiate a timely assessment of required changes in customer onboarding and communication processes, as well as compliance and operations processes, and begin implementation efforts as soon as possible. For Reporting Financial Institutions, substantial CRS data uplift requirements will likely need to be met to comply with reporting changes and new data elements. Crypto-Asset Service Providers should assess the entire package of MiCAR and the provisions of the Draft Law in a holistic manner to discern the impact on their business models and governance.