Control Agents in the Spotlight: CSSF FAQ Sets Out the Rules for DLT-Based Fund Tokenisation in Luxembourg

On 2 October 2026, the Commission de Surveillance du Secteur Financier (CSSF) published its first FAQ on Tokenisation (Version 1), providing practical guidance for Luxembourg undertakings for collective investment (UCIs) and market participants considering the use of distributed ledger technology (DLT) to issue, store, and transfer fund units or shares. You may see our general summary of the CSSF FAQ by clicking here: Tokenised Funds Gain Greater Certainty: CSSF Issues First Guidance on DLT-Based Fund Units in Luxembourg | DLA Piper.

Below we summarize the key information related to Control Agents.

 

Becoming a Control Agent

Entities wishing to perform control agent activities in Luxembourg must notify the CSSF at least two months prior to commencing such activities and include information sufficient for the CSSF to verify compliance with Article 21a(1) of the Dematerialised Securities Law. Before filing the formal notification, the CSSF strongly encourages entities to initiate a preliminary dialogue by providing a detailed presentation of the project and the full lifecycle of the assets involved — from issuance through trading, settlement, and distribution.

The notification timeline may be extended where elements of the activity are fully or partially outsourced or supported by ICT third-party arrangements, as additional notifications must be submitted to the CSSF at least three months before the start of the outsourcing (reduced to one month if outsourcing to a Luxembourg support PFS). Critically, the two-month period will only begin to run upon confirmation by the CSSF that the notification is complete. The CSSF may prohibit the notifying entity from carrying out control agent activities where the notification does not include sufficient information or where legal requirements are not complied with.

 

EEA Entities: Additional Cross-Border Steps

Any entity located in the EEA intending to act as a control agent in Luxembourg must first inform the competent authority of its home Member State and report any objection or comment from that authority to the CSSF. The entity must also ensure that the CSSF is in a position to verify, in cooperation with the home authority, compliance with Article 21a of the Dematerialised Securities Law — both at the time of notification and on an ongoing basis. This may involve bilateral cooperation arrangements between the relevant competent authorities. Non-compliance with these conditions may lead the CSSF to prohibit the entity from carrying out or continuing to carry out control agent activities.

 

DORA Applies to Control Agents

The CSSF takes the view that entities falling within the scope of Article 1(10a) of the Dematerialised Securities Law are subject to DORA (Regulation (EU) 2022/2554) in their entirety, including in respect of control agent activities. Entities must demonstrate, for the purposes of complying with Article 21a(1) of the Dematerialised Securities Law, that they have information processing systems and control and security arrangements suitable for the performance of their duties — including by ensuring that their DORA compliance framework covers their control agent activities.

 

Outsourcing Technical Support

A control agent may engage a third-party service provider to obtain technical support in the context of tokenisation of UCIs (e.g., smart contract development and/or administration). However, the CSSF considers it "highly likely" that the control agent activity qualifies as a critical or important function (CIF) within the meaning of Article 3(22) of DORA. Where ICT third-party arrangements are used to support the control agent activity, entities must comply with Circular CSSF 25/882 and notify the CSSF using the prescribed notification form within the applicable time limits. If an entity concludes differently in its self-assessment regarding CIF status, it must inform the CSSF and provide robust rationale before any official notification.