Luxembourg classified virtual asset service providers (VASPs) as high-risk entities for money laundering in its 2025 National Risk Assessment (NRA), highlighting concerns over the crypto industry’s exposure to financial crime.
According to the report, the inherent risk level of VASPs is deemed “High,” driven by factors including transaction volume, client reach, distribution channels, legal structures and the international scope of operations.
The NRA identified VASPs as an emerging risk in its 2020 report after “a detailed assessment of ML inherent risks emerging from virtual assets.” This was followed by a 2022 NRA report deeming “the risks associated with crypto assets and virtual currencies as very high,” because, among other things, they are internet-based and cross-border.
The European Union, of which Luxembourg is a founding member, has been working to regulate the cryptocurrency industry. A key part of this effort is the Markets in Crypto-Assets (MiCA) framework, which is designed to unify crypto regulation across all 27 EU member states.
Crypto value received by illicit addresses per year. Source: Chainalysis
According to reports this month, European law enforcement arrested 17 suspects of a “mafia crypto bank” for allegedly laundering over 21 million euros ($23.5 million) in crypto for Middle East and China-based criminal entities. As a result of the proceedings, 4.5 million euros ($5 million) worth of items were seized, including cash, crypto, 18 vehicles, four shotguns and several electronic devices.