Luxembourg funds can issue native tokens, but a consolidated view and careful control agent notification remain essential, says the CSSF.
On 2 October 2026, the CSSF published the first version of its FAQ on tokenisation, aimed at Luxembourg undertakings for collective investment ("UCIs") and other market participants exploring distributed ledger technology (“DLT”) for fund units and shares. The guidance confirms the technologically neutral approach the CSSF has thus far taken: the CSSF assesses tokenisation projects by reference to the underlying activity rather than the technology used.
Describe the whole project from day one
Entities considering a tokenisation project are encouraged to engage with the CSSF as early as possible and, when doing so for the first time, to provide a description of the whole project and the lifecycle of the assets involved, from issuance through to trading, settlement and distribution. This description should cover the legal qualification of the tokens, the role of every stakeholder, and details of all contractual arrangements, including outsourcing. The CSSF also expects a preliminary assessment of the licensing and notification requirements the project may trigger, since timing discrepancies between procedures, including the control agent notification, can affect the overall project schedule.
Native tokens confirmed
The FAQ confirms that Luxembourg UCIs may issue native units or shares, meaning units or shares issued solely on DLT in the form of tokens, without first existing in another form. Such tokenised units or shares may be registered or dematerialised, since using DLT as the issuance and record-keeping infrastructure does not itself determine the legal form of the underlying securities. For registered tokenised units or shares, the usual UCI administrator (“UCIA”) registrar function can be performed using DLT to maintain the register, while dematerialised tokenised units or shares still require an eligible entity to act as UCIA, in addition to complying with the law of 6 April 2013 on dematerialised securities.
Multiple UCIAs and the need for a consolidated view
Where a UCI issues both traditional and tokenised units or shares, multiple entities may act as UCIA for the registrar function in parallel, provided five conditions are met: no fragmentation of supervision or unjustified cost and complexity; proper disclosure of the operating model and its risks to investors, including each UCIA's role in the offering documents; and proper management of any additional risk arising from splitting the function. Importantly, the CSSF requires that one entity, whether the investment fund manager or one of the UCIAs, maintain a consolidated view of all units or shares issued by the UCI. This is essential so that other administration functions, such as net asset value calculation or distributions and capital calls, can be performed correctly across both the tokenised and traditional pools. It is also to be noted that there while the registrar function and the control agent function are different noting prevents a single entity holding authorisations to perform both functions.
Control agent: notification, questions and cross-border aspects
Section II of the FAQ deals with the control agent role under Article 21a of the law of 6 April 2013 on dematerialised securities. Control agents are investment firms, credit institutions or settlement organisations that maintain the securities issuance account through DLT and are responsible for tracking and verifying the holding chain of securities held in securities accounts on the DLT. Entities wishing to act as control agent must notify the CSSF at least two months before starting the activity and must provide sufficient information for the CSSF to verify compliance with the legal requirements. Where elements of the activity are outsourced or supported by ICT third-party arrangements, a separate notification is required, generally three months before outsourcing starts, reduced to one month for outsourcing to a Luxembourg support PFS.
An entity established in another EEA Member State intending to notify the CSSF as control agent must first inform its home competent authority, keep the CSSF informed of any objection or comment from that authority, and ensure the CSSF can rely on cooperation from the home authority to verify compliance with Article 21a, both at the time of notification and throughout the activity's life.
The FAQ also briefly touches on digital operational resilience and outsourcing: control agent entities fall within the scope of DORA and must apply their DORA compliance framework to the activity, and a control agent may use third-party technical support, for example for smart contract development, subject to the usual ICT third-party notification requirements where the activity qualifies as a critical or important function.
Share on
