3 October 2022 Giulio Farolfi Financial Regulation - Fintech - Technology

The Italian Register on virtual assets service providers: initial findings

It is now four months that the long-awaited register of Virtual Asset Service Providers (“VASPs”) has come into operation (on 16 May 2022). Since then, any VASP wishing to carry out business in Italy must first register, and those already operating had time until mid-July to comply. To date, already 72 VASPs have registered, including one natural person.

How does it work?

The register is held by the OAM, the Italian supervisory body that typically oversees intermediation activities in the credit and payments’ sector, while its legal basis can be found in paragraphs 8-bis and 8-ter of article 17-bis D.lgs. no. 141/2010, which were introduced with the national transposition of the 4th AML Directive. At that time, those provisions were pioneering since the corresponding EU law measures (included in the draft 5th AML Directive) had yet to be issued. However, after the Minister of Economy and Finance initially consulted on their implementing measures back in January 2018, the regulatory process had ground to a halt. It took them a long four years to overcome the impasse and finally issue, on 13 January 2022, the MEF Decree that regulates the VASPs’ registration. 

To register, VASPs must electronically apply to OAM, providing limited information on their contacts and type of business and few accompanying documents. This is because the registration is not conditional to proving any specific requirement, thus OAM shall only review the regularity and completeness of the application. The only condition regards territoriality aspects: the VASP must be domiciled or incorporated in Italy. VASPs not incorporated in the EU cannot apply, while EU ones can do so only if they have a permanent establishment in Italy (so far, more than 20 EU VASPs have therefore opened an establishment). This approach was criticized by a few authors but is justified by the fact that having premises in Italy allows the police to conduct physical inspections, therefore enabling effective controls and helping to prevent illegal activities.

That said, VASPs operating in Italy are subject to the Italian AML/CTF legislation, as well as to the other frameworks generally applicable, including consumer and data protection measures. Accordingly, before VASPs start operating they still need to put in place all the arrangements, procedures and controls necessary to ensure compliance with these rules. 

Finally, the registration regime includes supervisory fees and, most notably, ongoing reporting obligations. This is likely the most burdensome provision of the decree, considering that on a quarterly basis VASPs will have to submit to OAM data related to their crypto business conducted in Italy. This will enable the Italian authorities to have a comprehensive view of the VASP market in Italy, and this significant set of data may inform future policy actions. 

Our thoughts
  • By looking at the current state of the register, the first thing that comes to one’s mind is the wide range of business models of the operators who have enrolled, from trading platforms (Bitpanda) to exchangers (Binance, The Rock Trading, Young Platform), to custodians (Conio, Checksig), to operators of crypto-ATMs (Cls), to companies operating in the broader fintech sector (Tinaba, Vivid). This reflects the wide definition of “provider of services relating to the use of virtual currencies” on which the registration requirement is based, which notably includes any service for the use of virtual currencies, for their exchange (from or into fiat currency or other virtual currencies), for their issuance and offering, for their transfer and clearing, or that is in any way functional to the acquisition, trade or intermediation in the exchange of virtual currencies, such as execution, RTO, placing and advisory (which all mirror the traditional investment services). 
  • Given the breadth of this definition, it seems reasonable to adopt a prudent approach when determining the VASP perimeter, and therefore to construe the registration requirement extensively. Only “merchants who accept virtual currencies as consideration for the provision of goods, services or other utilities” may safely be excluded, as the wording which was drawing them in scope had been removed from the final version of the MEF decree (and a representative of the Ministry confirmed so in a parliamentary hearing). It is instead unclear whether platforms and marketplaces who display goods and services of these merchants could also benefit from this exemption, given their role in the use of virtual currencies. Also, NFTs-related services appear to be outside of these rules, provided they do not meet the Italian law definition of “valute virtuali”.
  • On the other hand, it seems widely accepted that regulated firms operating in the financial sector would also need to register with OAM should they wish to provide services in relation to virtual currencies. However, currently there are no incumbents listed in the Register.
  • Another aspect which has not been clarified in the MEF Decree is when the business of VASPs shall be deemed to be “carried out in Italy”, even online (nor can we expect clarifications from OAM, as it does not have the power to issue interpretative rules). Since the MEF Decree does not contain any indication on the point, it seems reasonable to refer to the guidance provided over the years by the Italian supervisory authorities for their respective sectors of competence, which have traditionally endorsed a “solicitation test” whereby licensing requirements are triggered to the extent that Italian customers are sought. In this respect, one of the elements typically regarded as suggesting a foreign firm’s intention to carry out business in Italy is the use of Italian language on its website. It is also worth mentioning that the existing VASP regime does not contain any rule on reverse solicitation, and therefore foreign VASPs would not be able to safely hang on to that. 
  • Finally, it is yet to be determined the interplay between these Italy-specific rules and those that will be introduced by the Markets in Crypto Assets Regulation, whose adoption is expected for March 2023 (with application date no earlier than 2024).
Next steps

In light of all the above, we note there is still a great deal of uncertainty around this new registration requirement. A more in-depth analysis of the potential developments of this regime is therefore required and will largely be based on how the VASPs market in Italy will respond. We will report on this in due course.