CSSF FAQ on Fund tokenisation

On 2 October 2026, the CSSF published its FAQ on Fund tokenisation, confirming the technology-neutral approach to tokenisation (i.e. the digital representation of assets on distributed ledgers or the issuance of traditional asset classes in tokenised form to enable them to be issued, stored and transferred on a distributed ledger). It provides additional guidance on I) Tokenisation of investment funds, and II) Control agent specificities.

I) Tokenisation of investment funds

Luxembourg funds may issue native shares on a Distributed Ledger Technology (DLT) subject to having an operating model in place compliant with the applicable regulatory framework. They can issue tokenised shares in registered form (titres nominatifs) or dematerialised form (titres dématérialisés).

For UCIs with registered shares, any UCI Administrator¹ performing the registrar function may use DLT to maintain the shareholder register. For UCIs issuing dematerialised shares using DLT, an eligible entity (e.g. the IFM, a registrar agent or a credit institution authorised as UCI Administrator) will need to act as UCI Administrator for the registrar function in addition to compliance with the Law of 6 April 2013 on dematerialised securities. The appointment of a control agent within the meaning of the Law of 6 April 2013 on dematerialised securities does not remove the need to appoint a UCI Administrator for the registrar function. A UCI Administrator can also be authorised to act as control agent of the DLT and dematerialised securities provided that it holds all required licences and authorisations and has completed the applicable control-agent notification requirements explained below.

For funds issuing both tokenised shares and traditional shares, various entities may be appointed to act as UCI Administrators for the registrar function of one fund subject to the following conditions:

1. No fragmentation, and supervision and cost management: the division of tasks between the different UCI Administrators must not result in a fragmentation rendering the coordination and general supervisory function difficult or impossible, or which unnecessarily increases costs with duplication or complexity of the operating model;
2. Disclosures to investors: Adequate disclosure to investors of the operating model, potential risks and implications, including names of all entities acting as UCI Administrator and their respective functions;
3. Consolidated view: the Investment Fund Manager and/or one of the UCI Administrators must maintain a consolidated view of the shares issued, ensuring the performance of all other relevant UCI administration functions (e.g. calculation of the NAV per share, calculation of distributions/capital calls, etc);
4. Risk management obligation: the Investment Fund Manager and/or the fund must ensure that any additional risks arising from this division of responsibilities for the registrar function are properly managed;
5. Compliance with applicable law: full compliance with all relevant provisions of the applicable law, such as the Law of 10 August 1915 on commercial companies, must be ensured, including, where applicable, the obligation to maintain a register of all registered shares at the fund’s registered office.

II) Control agent specificities

To perform control agent activities in Luxembourg, the applicant must notify the CSSF at least two months prior to the control agent’s activity taking place and shall include the information necessary to allow the CSSF to verify compliance with the requirement of robust internal governance arrangements, clear structure, well-defined, transparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks, adequate internal control mechanisms with administrative and accounting procedures, information processing systems and related control and security arrangements, and adequate professional experience. The two-month regulatory period only begins once the CSSF has confirmed that the notification is complete.

In case of full or partial outsourcing or support of the control agent activity with ICT third-party arrangements, additional CSSF notifications may need to be submitted, which may increase the timeline for control agent notification, as they must be submitted at least three months before the start of the outsourcing, or one month if the outsourcing is to a Luxembourg support PFS. In the event that the CSSF does not prohibit the notifying entity from carrying out the control agent activity, the notifying entity may start it.

Any entity located in the European Economic Area intending to notify the CSSF for the control agent activity must first inform its home Member State competent authority and the CSSF of any objection or comment of such competent authority, and ensure that the CSSF can verify, before the start of the activity, that the competent authority will assist the CSSF (e.g. bilateral cooperation arrangement).

The CSSF further clarifies that the control agent as a whole is subject to DORA requirements and they must demonstrate information processing systems and related and suitable control and security arrangements which include compliance with the DORA framework. A control agent can have recourse to a third-party service provider to obtain technical support in the context of the fund tokenisation (e.g. smart contract development and/or administration). It is highly likely that the control agent activity qualifies as a critical or important function (CIF) for DORA, and the applicant which considers the use of ICT third-party arrangements to support their control agent activity must refer to Circular CSSF 25/882 and notify the CSSF using the relevant notification form within the applicable time limit. Regarding the application as CIF under DORA, if the applicant has another different assessment, a robust rationale must be provided to the CSSF upfront any official notification.

As a reminder, a UCI Administrator planning substantial changes to its operating model to use DLT must apply to the CSSF for authorisation of any substantial changes to its initial application and authorisation.

Entities that consider relying on tokenisation are invited to contact the CSSF and initiate a preliminary dialogue to identify the need for authorisations, licences, and any potential obstacles at an early stage, with a detailed presentation before initiating the formal procedures. To initiate a preliminary dialogue, entities may contact the CSSF’s Innovation Hub (innovation@cssf.lu). When contacting the CSSF for the first time, entities are invited to provide a description of the project and lifecycle of the assets involved from their issuance to their trading, settlement, and distribution.

¹ For the purposes of the CSSF FAQ, a UCI Administrator means an entity, as defined in section 2.1 of Circular CSSF 22/811, performing UCI administration activities.

Get in touch with our Luxembourg Team to discuss how these developments may impact your strategy and how we can support you with structuring, regulatory engagement, and compliance readiness.