CSSF Issues FAQ on Tokenisation of Luxembourg Funds

Luxembourg supervisory authority for the financial sector, the Commission de Surveillance du Secteur Financier (CSSF) published a new set of frequently asked questions on tokenisation (Tokenisation FAQ)¹ addressing the tokenisation of units or shares of Luxembourg undertakings for collective investment (UCIs) and the role of control agents under the Luxembourg act of April 6, 2013 on dematerialised securities, as amended (the Dematerialised Securities Act). The Tokenisation FAQ sets out the CSSF's position on native issuance of fund units on distributed ledger technology (DLT), the interaction between the registrar function and the control agent function, and the regulatory requirements applicable to control agents.

Background and Scope

The Tokenisation FAQ does not purport to be a complete guide to tokenisation under Luxembourg law, but rather lists recurrent questions raised with the CSSF in this context.

Consistent with its technology-neutral approach, the CSSF confirms that it evaluates the risks of tokenisation-based business models by reference to how the technology is used, rather than the technology itself. Entities considering a tokenisation project are invited to engage with the CSSF (via their usual point of contact for supervised entities, or via the CSSF Innovation Hub for others) at an early stage, providing a description of the whole project and asset life cycle, a legal qualification of the tokens to be issued (including attached rights), details of all stakeholders and contractual relationships (including any outsourcing), and a preliminary assessment of licensing requirements.

Native Issuance of Units or Shares of UCIs on DLT

UCIs encompass undertakings for collective investment in transferable securities (UCITS) as well as alternative investment funds (AIFs) whether formed as investment companies with variable capital² or as common funds.³

Under Luxembourg Companies Law,⁴ shares can be issued as bearer shares, as registered shares or as shares in dematerialised form. UCIs in the form of common funds issue units.

The Tokenisation FAQ confirms that the CSSF is comfortable with Luxembourg UCIs issuing units or shares using DLT and to view this issuance as being a native issuance, provided the operating model complies with the regulatory framework applicable to the relevant UCI. This closes the discussion whether the issuance of units or shares of a UCI via DLT could be considered as the sole binding issuance or whether a traditional register would need to be maintained with the need for an on-going reconciliation between the issuance using DLT and the traditional register.⁵ The Tokenisation FAQ further clarifies that the use of DLT does not determine the nature of the units that are issued by the UCI. It furthermore clarifies that the form in which units are issued by the UCI (e.g., registered or dematerialised) does not affect the requirement for the UCI to appoint an administrator to perform the registrar function within the meaning of Circular CSSF 22/811⁶ (UCIA).⁷

If the UCI is issuing registered units or shares, the UCIA may use blockchain technology to maintain the register of shareholders or unitholders. The use of blockchain technology for the maintenance of the register does not impact the way units are issued by the UCI.

If the UCI is issuing dematerialised units or shares, the Dematerialised Securities Act requires the issuer to appoint a control agent. The control agent can be an investment firm,⁸ a credit institution,⁹ or a settlement organisation¹⁰ that the issuer of the dematerialised securities (e.g., the UCI) designates to hold the issuer's issuance account on a distributed ledger or other secure electronic recording device, and to oversee and reconcile the dematerialised securities recorded on it. This operates essentially as a DLT-based substitute for the traditional central account keeper or settlement organisation but confined to electronic-recording-device-based issuance accounts.

The Tokenisation FAQ clarifies that the UCIA's duties exceed those required of a control agent. Accordingly, a UCI issuing dematerialised units must appoint both a UCIA and a control agent, though a single entity may perform both roles if duly authorised.

The CSSF furthermore reminds that a UCIA planning substantial changes to its operating model in connection with its use of DLT must apply to the CSSF for authorisation of such changes, in accordance with Circular CSSF 22/811.

Multiple UCIAs for the Same UCI Issuing Both Traditional and Tokenised Units/Shares

Traditionally, the CSSF considered that a Luxembourg UCI should only appoint one UCIA. The CSSF clarifies in the Tokenisation FAQ that where a UCI is issuing both tokenised and traditional units, multiple entities may act as UCIAs in charge of the registrar function for that same UCI, provided that the following conditions are fulfilled:

• The division of tasks does not fragment supervisory oversight or create unjustified cost or complexity.
• The operating model and related risks are adequately disclosed to investors, including naming all UCIAs and their functions in the fund offering documents.
• A consolidated view is maintained of all units that are issued to allow the calculation of the net asset value and other administration functions to be performed for the UCI.
• Risks arising from the division of responsibilities are properly managed for the UCI that actively involves the UCITS management company or the AIFM of the UCI.
• All applicable legal requirements continue to be met, including maintaining the register of registered shares at the UCI's registered office.

Guidance on Becoming a Control Agent

The Dematerialised Securities Act requires a control agent to have a clear organisational structure with well-defined, transparent and consistent allocation of responsibilities; effective risk-detection, management, control, and reporting processes; adequate internal control mechanisms, including sound administrative and accounting procedures; and IT systems and related control and security mechanisms.

The Tokenisation FAQ sets out the procedure for becoming a control agent. After an initial presentation of the operating model to the CSSF, the entity wishing to carry out the function of a control agent must notify the CSSF at least two months before starting control agency activities. The notification (which is not a full authorisation process) requires the control agent to provide information that is sufficient for the CSSF to verify compliance with Dematerialised Securities Act.¹¹ Partial outsourcing of the control agency activity or the use of ICT third-party arrangements must also be notified to the CSSF before the outsourcing or the ICT third-party arrangements starts.

The CSSF may prohibit an entity from carrying out control agency activities where the notification is incomplete or the legal requirements are not met. The notification period only starts running once the CSSF confirms the notification is complete. Entities established in other EEA Member States must first inform their competent supervisory authority and ensure that the latter will cooperate with the CSSF in verifying ongoing compliance with the Dematerialised Securities Act.

Compliance with DORA and Circular CSSF 25/882

The CSSF confirms in the Tokenisation FAQ that control agents fall within the scope of DORA.¹² Control agents must therefore demonstrate that they have information processing systems and control and security arrangements suitable for complying with DORA.

Furthermore, the CSSF confirms that a control agent can use a third-party service provider for technical support in a tokenisation context. The CSSF considers it highly likely that the control agent activity qualifies as a critical or important function within the meaning of DORA.¹³ Where ICT third-party arrangements support the control agent’s activity, applicants must comply with Circular CSSF 25/882¹⁴ and submit the DORA critical-or-important-function notification form within the applicable time limits.

Conclusion

After the CSSF updated its FAQ on crypto assets for UCIs in February of this year,¹⁵ the Tokenisation FAQ is the CSSF's first dedicated statement on fund tokenisation. It confirms several points that were previously developed in practice, in particular that native DLT issuance of fund units is permitted, that the control agent and UCIA registrar functions are distinct and generally cumulative, and that DORA compliance obligations extend fully to control agent activities.

In this context, it will be interesting to see which fund tokenisation model would ultimately prevail in the market: fund units that are issued as traditional registered units with a register that is using blockchain technology, or dematerialised fund units with the involvement of the control agent? For the latter case, it will also be interesting to see whether fund administrators will act as control agent, or whether the control agency function would be assumed by separate providers.

Sponsors and fund administrators considering tokenised fund structures should engage with the CSSF at an early stage and ensure their operating models, disclosure documents and notifications are updated accordingly. The Tokenisation FAQ will be updated progressively as further issues arise in practice.