Luxembourg sees major risks with providers of crypto services

Luxembourg warns that companies that offer services around virtual currency (so -called vasp’s) are in high risk to be abused for money laundering. This is stated in the National Risk Assessment (NRA) of 2025.

4 reasons for high risk

According to the NRA, virtual assistant services are vulnerable because they:

• Trading large amounts;
• Many customers serve, including internationally;
• Working through online channels;
• Have complex business structures.

In earlier reports, Luxembourg already signaled this risk. In 2020, the NRA Vasp’s called “emerging risk”. In 2022 the risks were called “very high”, because crypto can easily be used cross -border and can be used via the internet.

European rules in the making

The European Union is working on one set of rules for all Member States: the MICA framework (Markets in Crypto-Assets). The aim is to make the cryptomarkt safe and clear. Since January 2025, VASPs can apply for permits to operate legally in the EU.

• OKX was the first to get a full mica license in January.
• Kraken started in May with regulated trade in derivatives.
• Crypto.com received a permit for the same activities.
• Tether (USDT), the largest Stablecoin in the market,, however, chose not to comply with the new rules and was taken from the EU platforms.

Global examples of abuse

The worries are not unfounded. This month:

• Hong Kong arrested 12 suspects for a project that has more than 118 million HKD (15 million USD) Witwaste via Crypto.
• European police picked up 17 people who Witsten EUR 21 million (EUR 23.5 million) for organized crime. In addition, 4.5 million EUR, 18 vehicles, firearms and electronics were seized.

Luxembourg emphasizes that strict rules and international cooperation are needed to keep the financial system clean now that the cryptomarket is growing.