On 29 November 2019, the German legislator adopted new rules on crypto assets. The new rules have been adopted as part of the implementation of fifth Anti-Money Laundering (AML) Directive of 30 May 2018. Under the fifth AML Directive, the domestic law of EU member states has to provide that custodian wallet providers are subject to AML requirements. In this context, “custodian wallet providers” are defined as entities that provide services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual currencies. Rather than amending the German AML Act (Geldwäschegesetz (GWG)), the German legislator has decided to take a much broader approach. The new law contains, among others, changes to the German Banking Act Kreditwesengesetz (KWG), which states that:
Crypto assets qualify as financial instruments
Trading with crypto assets and the custody of crypto assets as a service for others require a license from the German Federal Financial Supervisory Authority (BaFin) as a bank or as an investment firm
Entities that provide no other financial services than custody are exempted from certain rules that apply to other investment firms
Crypto assets qualify as financial instruments
Whether or not crypto assets qualify as financial instruments have a significant impact on the applicable regulatory framework. If crypto assets qualify as financial instruments, entities trading with such assets or providing custody services with respect to them may require a license as a bank or an investment firm. Banks and investment firms must also comply with regulatory requirements such as capital requirements and AML requirements.
The qualification of crypto assets as financial instruments was disputed in the past. The BaFin took the view that utility tokens did not qualify as financial instruments. However, according to the BaFin, investment tokens qualify as securities, which fall under the definition of financial instruments pursuant to the German Banking Act. The BaFin also took the view that currency tokens qualify as “units of account” (Rechnungseinheiten), which also falls under the definition of financial instruments pursuant to the German Banking Act. A decision by the district court (Kammergericht) of Berlin dated 19 October 2018, opposed this view and held that payment tokens did not qualify as financial instruments; however, this decision had no impact on BaFin’s
administrative practice.
The new law defines crypto-assets as “the digital representations of a value that has not been issued or guaranteed by any central bank or public authority and that does not have the legal status of currency or money, but which is accepted as a means of exchange or payment or for investment purposes by any person or entity on the basis of an agreement or according to market practice, and which can be transmitted, stored and traded electronically”.
This definition is rather broad and can include utility tokens, investment tokens, payment tokens, as well as hybrids thereof.
Licensing requirements for the custody of crypto assets
The new rules also include a licensing requirement for the safeguarding, the administration and the securing of crypto assets as a service for others. According to the legislative reasoning, “safeguarding” means that the service provider saves crypto assets of the customers in a collective account to which the customers have no key. The “administration” of crypto assets means the exercising of rights arising from the crypto-assets (such as voting rights). The ‘securing’ of crypto assets include the securing of the private key of the customers as well as the securing of physical media on which such keys are recorded. This does not apply to the mere offering of storage capacity (such as web hosts or cloud storages), provided that such storage space is not explicitly offered for the securing of private keys. Thus, custodian wallet providers will be subject to license requirements if they offer their services in Germany. According to German banking law, the offering of services “in Germany” does not require a physical establishment in Germany.
Any activity by which an entity incorporated or resident outside Germany solicits business from persons in Germany is regarded as the offering of services in Germany. Only if the German customer contacts the service provider without having been solicited to do so, the service provider will not be deemed to conduct the custody business in Germany (so-called “reverse solicitation”). If services are provided on the Internet, there is often only a thin line between soliciting customers in Germany and reverse solicitation.
Requirements for a license for the crypto asset business
Entities that require a license only for the crypto asset business, but not for any other type of banking business or financial service, will have to comply, inter alia, with the following requirements:
An initial capital of €125,000
The management must have sufficient experience and be reliable
The firm must have a proper business organisation (this includes the rules applicable to outsourcing and risk management as well as IT security which apply to banks and other investment firms)
Certain notification requirements (i.e. if the capital falls below certain thresholds or if managing directors resign or are appointed)
Entities that provide no licensable services other than the custody of crypto assets are exempted from a number of regulatory requirements that generally apply to investment firms. This mainly applies to certain requirements related to capital buffers and liquidity and regulatory capital requirements under the Banking Act and the CRR.
Further licensing requirements
Since the legislator has now clarified that crypto-assets qualify as financial instruments, any banking business or financial service relating to financial instruments will require a license if such a banking business or financial service is conducted or provided in relation to crypto-assets.
For example, the operation of a multilateral trading system (MTF) that brings together multiple third-party buying and selling interests in financial instruments according to non-discretionary rules, qualifies as a licensable investment service. Depending on their specific set-up, it is likely that some crypto-asset trading platforms may qualify as MTFs.
In addition, the purchase and sale of financial instruments as an agent for others qualifies as a licensable banking business or financial service. Thus, if such activity is conducted with respect to crypto-assets, the service provider will have to obtain a license as a bank or investment firm.
Pure proprietary trading, which is not provided as a service for others, does not qualify as a licensable business. However, it should be noted that own account trading that is conducted with a view to purchasing and selling crypto assets to customers does not qualify as proprietary trading and may, therefore, be subject to licensing requirements.
Changes in comparison with the draft rules
A draft version of the new rules provided that entities that hold a license for the custody of crypto assets may not provide any other licensable business. This would have meant that, for example, an entity that holds a license for the operation of an MTF would have been excluded from offering the custody of crypto assets. This was mainly based on IT security considerations. The legislator was concerned that custodians of crypto assets would often be a target of hackers and that in case of a successful hack, not only the custody business but also other businesses of the same entity may be affected. However, this strict separation rule was abandoned in parliament.
Transition periods
The new law came into force on 1 January 2020, subject to certain transition periods. Entities which require a license for the custody of crypto assets, or which require a license due to the extension of the definition of “financial instruments”, may notify the BaFin on or before 31 March 2020, of their intention to obtain a license. In such a case, the license will be deemed to be awarded on a preliminary basis, provided that they will submit a complete application for a license no later than 30 November 2020.
Firms that provide custody services with respect to crypto-assets or other services related to crypto-assets are advised to consider the implications of the new rules, in particular, whether they need to obtain a license. Please note the deadline of 31 March 2020, for indicating the intention to obtain such a license to the BaFin.
Please also note the deadline of 30 November 2020, for the submission of a complete application for a license.
Although about one year from now, it should be noted that the preparation of a complete application may require a considerable amount of time and effort.
