New VASP licensing rules affecting recovery in Luxembourg – financial forensics

As of early 2026, Luxembourg's regime for virtual-asset service providers has entered a new phase. The country's financial-sector supervisor has completed its transposition of the Markets in Crypto-Assets framework, meaning that VASPs operating in or through Luxembourg now require an explicit licence rather than a lighter registration. That shift changes the information environment for anyone tracing funds through Luxembourg-based platforms – and it changes it fast.

The practical effect for asset-recovery work is this: licensed VASPs in Luxembourg are now subject to stronger know-your-customer and record-keeping obligations, which in turn creates a more defined legal pathway for disclosure orders directed at those entities. A properly scoped disclosure order against a licensed VASP can compel production of account and transaction data that was previously harder to reach. The window to act on fresh movement, however, remains narrow.

This alert sets out what changed, who is affected, and what to do now if funds you are tracing have passed through Luxembourg on-chain or off.

What has changed for VASPs operating in Luxembourg?

Luxembourg's supervisor has moved from a registration-only model to a full licensing requirement. A VASP that formerly notified the regulator and operated under general anti-money-laundering rules must now meet ongoing capital, governance, and compliance standards to retain its authorisation. Platforms that cannot meet the new threshold face suspension or withdrawal of permission to operate.

This licensing shift produces a direct evidentiary consequence: the regulator holds more granular supervisory data on each licensed entity. For follow-the-money purposes, that matters. A disclosure order directed at the supervisor, or at the VASP itself, can now be grounded in the VASP's statutory obligations rather than in a voluntary information request. In our experience, regulatorily anchored disclosure requests move faster and encounter less resistance.

There is a second effect. VASPs that fail to obtain a licence, or that lose one, do not simply disappear. Some migrate. Funds held at an unlicensed or de-listed platform create a different problem: the legal handle for a disclosure order weakens because the entity is no longer subject to supervisory oversight in Luxembourg. Asset tracing then shifts to on-chain methods and to the correspondent banking relationships the platform maintained before its departure.

Who is affected – and where does the lost-opportunity risk arise?

Three categories of claimant face direct exposure to this change.

• Defrauded principals whose funds moved to a Luxembourg-registered exchange before or during the licensing transition. If those funds are still on-platform, a disclosure order and, where warranted, a freezing order over digital assets can still reach them – but only if the VASP remains licensed and the account is identified before the position is moved.
• Insolvency practitioners tracing assets stripped from an estate that were converted into crypto and routed through a Luxembourg VASP. The licensing register now provides a cleaner route to confirm whether the receiving platform is subject to Luxembourg supervision.
• Referring lawyers and funders assessing whether a Luxembourg-routed crypto trail supports a viable recovery. The licensing status of the receiving VASP is now a threshold question: licensed means a legal handle exists; unlicensed means the strategy pivots to on-chain tracing and cross-border letters of request.

The lost-opportunity risk is real and time-bound. A licensed VASP that freezes a position on legal process today may, in weeks, become an unlicensed one if it fails regulatory review. Once a platform loses its authorisation, enforcing a disclosure or freezing order against it becomes significantly harder. Practitioners who identify a Luxembourg VASP connection should verify licensing status before investing in an application.

What to do now

Speed and sequencing decide outcomes here. Three immediate steps apply to any matter with a Luxembourg VASP connection.

First, confirm licensing status. The supervisory register is public. A VASP that appears licensed today may be under review or have conditions attached. Instructing local counsel in Luxembourg at this stage is essential – Luxembourg procedure governs any filing, and local admitted counsel must act on the ground.

Second, secure the on-chain record. Even if a legal process is filed promptly, the underlying blockchain data is your independent record. On-chain tracing establishes the movement of funds in a way that does not depend on the VASP's cooperation. We regularly advise clients to run parallel tracks: on-chain analysis to map the trail, and legal process to compel disclosure from the platform. One reinforces the other.

Third, assess the cross-border picture. Funds rarely stop in Luxembourg. A typical pattern sees proceeds arrive from a foreign jurisdiction, pass through a Luxembourg VASP, and exit toward a further exchange or a bank account in a third country. A Bankers Trust order, or its functional equivalent in the relevant forum, may be needed to trace the exit leg. A worldwide freezing order remains available in forums with strong cross-border reach, and can in principle cover assets wherever they have settled – subject to conditions and safeguards in the courts involved.

Do not assume that missing records mean the trail is dead. We reconstruct payment trails from partial records – blockchain data, correspondent bank flows, and corporate-registry entries – and identify where value has settled. The paper trail being incomplete is the starting point of a forensic investigation, not its end.

If funds you are tracing have passed through Luxembourg and you are uncertain whether the receiving VASP is still reachable, a confidential case review will tell you whether a legal handle still exists. Contact us at info@axiomtracel.com to discuss your matter.

About Axiom Trace

Axiom Trace is an independent boutique focused on cross-border and crypto asset recovery. We trace assets that have moved across borders or on-chain and coordinate their freezing and recovery – working with defrauded principals, insolvency practitioners, and the lawyers and funders who refer them. We work lawfully and within applicable sanctions regimes, alongside local counsel where proceedings must be filed. We coordinate closely with admitted local counsel in Luxembourg; local procedure governs the filing. Our forensic work covers asset tracing, follow-the-money analysis, and disclosure applications directed at VASPs and banks. To discuss a matter, contact info@axiomtracel.com.

For further analysis of financial-forensics methodology, visit our Financial Forensics insight hub. For jurisdiction-specific context, see our Luxembourg jurisdiction guide. Practitioners dealing with source-of-funds questions in this market may also find our guide to source-of-funds investigations in Luxembourg directly relevant.

Disclaimer: This publication is for general information only and is not legal advice, nor a promise or prediction of recovery. No outcome is guaranteed. Asset recovery depends on the specific facts and on the law and procedure of each relevant jurisdiction, where local admitted counsel must act. Axiom Trace coordinates closely with admitted local counsel in Luxembourg; local procedure governs the filing. Axiom Trace assumes no liability for actions taken or not taken based on this material. For advice on your situation, contact info@axiomtracel.com.