New Italian Rules on Virtual Asset Service Providers

Read the article written by Angelo Messore, Francesco Dagnino, Carlo Giuliano and Filippo Belfatto – Click here for the pdf version.

The decree of the Italian Ministry of Economy (“MEF”) setting out the new rules applying to virtual asset service providers (“VASP”) operating in Italy has been published in the Italian Official Journal (the “VASP Decree”).

All VASPs providing their services in Italy must be enrolled in a dedicated section of the register of money changers (the “VASP Register”) kept by the Italian competent authority (Organismo Agenti e Mediatori) (“OAM”).

VASPs will be subject to quarterly reporting obligations to the OAM on the transactions made by their clients, and will have to comply with the Italian AML requirements.

The OAM will have to establish the VASP Register within 90 days of the date of entry into force of the VASP Decree. A 60-day transition period will apply to VASPs that already operate in Italy when the VASP Register will be established.

▼                  ▲                  ▼

VASP registration requirements

The VASP Decree – which was approved on 13 January 2022 and published in the Italian Official Journal on 17 February 2022 – implements the requirements set out under article 17-bis of the Legislative Decree No. 141/2010 (the “Decree 141/2010”) introduced in the context of the implementation of the 4^th AML Directive in Italy (which were later amended with the transposition of the 5^th AML Directive). These rules already required VASPs to be enrolled in the VASP Register kept by the OAM.

The VASP Register was still due to be established though, pending the enactment of the implementing decree regulating the notification obligations to the MEF. VASPs already had to comply with the Italian AML requirements set forth in the Legislative Decree No. 231/2007 (the “Italian AML Decree”).

On 2 February 2018 the MEF launched a public consultation on the draft version of the decree. Four years after the consultation, the MEF approved the VASP Decree. The VASP Decree differs in several respects from the original proposal, as it defines, among others, the requirements applying to VASPs in order to be enrolled in the VASP Register, as well as the reporting obligations to which VASPs will be subject following such registration.

Scope of the new rules

The VASP Decree applies to all VASPs operating in Italy.

The scope of the new rules is based on the definition of “virtual currency” laid down in the Italian AML Decree, which largely reflects the corresponding definition of the 5^th AML Directive.

Under the Italian AML Decree a virtual currency is defined as a digital representation of value that is not issued or guaranteed by a central bank or by a public authority, is not necessarily attached to a legally established currency, but is accepted as a means of exchange to purchase goods or services or for investment purposes, and can be transferred, stored and traded electronically.

The notion of VASPs that are subject to the regime introduced under the VASP Decree – as well as to the Italian AML Decree – includes providers of services related to the use of virtual currencies and custodian wallet providers, as per the following definitions.

• Providers of services related to the use of virtual currencies: any individual or legal entity carrying out by way of business and towards third parties services (including on-line services) that are instrumental to the use, exchange, conservation of virtual currencies and their exchange from or into fiat currencies or digital representations of value (including those that can be exchanged for other virtual currencies), as well as any service concerning the issue, offer, transfer and clearing and any other service that is instrumental to the purchase, trading or intermediation in the exchange of the above currencies.
• Custodian wallet providers: any person or legal entity providing, by way of business and towards third parties, services (including on-line services) to safeguard private cryptographic keys on behalf of its customers, in order to hold, store and transfer virtual currencies.

The accompanying report to the VASP Decree clarifies that the obligations set out under the VASP Decree apply also in the event that VASPs (including VASPs established abroad) operate in Italy remotely through digital tools, also by using websites or apps offering such services in Italian.

Conditions for the registration

The VASP Decree clarifies that only VASPs that are enrolled in the VASP Register can offer services related to virtual currencies or custodian wallets in Italy.

VASPs that are not enrolled in the VASP Register will not be allowed to operate in Italy once the VASP Register will be established.

In order to be enrolled in the VASP Register, VASPs must comply with the same requirements applying to money changers. For VASPs established as legal entities, the only requirement is to have the registered and administrative office in Italy or, in case of EU entities, a branch (stabile organizzazione) in Italy.

Accordingly, VASPs that are incorporated in other EU Member States will have to set up an Italian branch or subsidiary in order to operate with Italian customers. VASPs established in third countries will have to incorporate an Italian subsidiary.

OAM notification

VASPs intending to carry out their activity in Italy (including on-line) must send a notification to the OAM, which must include the following information in case of legal entities:

• identification data of the company or the branch – i.e. name, legal form, tax identification number / VAT number (if any), registered office and administrative office (if different from the registered office), registered address of the branch in case of companies incorporated in other EU Member States;
• identification data of the legal representative (surname, name, place and date of birth, tax identification number (if any), data of the identification document);
• certified email address to be used for the communications with the OAM;
• information on the type of business that it performs (provider of services related to virtual currencies and/or custodian wallet provider);
• type of service offered to the customers;
• modalities used to carry out the business, with information on the number and address of any physical offices used to this end (including any ATMs), and/or on the on-line business (including the web address used for the provision of the service).

Filing of the notification and registration procedure

The OAM notification will have to be sent electronically, by using the restricted area of the OAM website.

The applicant must attach a copy of the identification document of the legal representative and an excerpt of the Companies’ Register to the notification.

The OAM must be notified within 15 days of any change to the data included in the communication. This update can also be given electronically.

The OAM verifies whether the notification and documentation are complete and consistent with the applicable requirements, and must approve or reject the application within 15 days of the date when the notification is filed. The procedure can be suspended only once for a period not exceeding 10 days, if the application is incomplete or if the OAM requests the transmission of additional documents.

The notification made to the OAM satisfies at the same time the notification obligation to the MEF provided for under the Decree No. 141/2010. Accordingly, there will be no need to make two separate filings – i.e. one to the MEF and another one to the OAM – contrary to the approach envisaged under the Decree No. 141/2010 and the draft decree published in the context of the original consultation.

The VASP Register

The OAM will have to establish the VASP Register within 90 days of the entry into force of the VASP Decree (i.e. by no later than 18 May 2022).

The VASP Register will be publicly available and the following data will be published:

• identification data of the VASP;
• tax identification number or VAT number (if any);
• information on the type of services offered to the customers;
• address of the physical offices used to carry out the business (including any ATMs), and/or the web address used for the provision of the service.

The OAM will be entitled to suspend or cancel VASPs from the VASP Register, and will have to determine the supervisory fees to be paid by VASPs.

Transition period

According to the VASP Decree, VASPs that operate in Italy on the date when the VASP Register is established and satisfy the conditions for the registration in the VASP Register must transmit the OAM notification within 60 days of such date.

If the VASP fails to make such filing, the notification requirement is not met and the VASP is deemed to operate illegally in the Italian territory.

As a result of the foregoing, the VASP Decree introduces a 60-day transition period during which VASPs that already operate in Italy may continue to operate, provided that they file the required notification to the OAM within such term and they establish a local presence (i.e. branch or subsidiary) in Italy. Assuming that the VASP Register will be established in mid-May 2022, the transition period will last until mid-July 2022.

List of services related to virtual currencies

The VASP Decree includes a description of the different types of services related to virtual currencies that VASPs are allowed to carry out.

Although the list of services is included only for the purpose of the notification to the OAM, this list is particularly important in order to further define the scope of the rules set forth in the VASP Decree.

Based on the VASP Decree, the registration requirements are triggered if a person offers one or more of following services:

The above classification reflects the recommendations issued by the GAFI/FATF for AML purposes. At the same time, it anticipates some of the criteria set out in the proposal for a regulation on market in crypto-assets (the “MiCA Regulation”) published by the European Commission in September 2020 – which is still due to be approved at EU level.

The accompanying report to the VASP Decree clarifies that the simple issue of virtual currencies does not trigger in itself the duty to enrol in the VASP Register, unless the issuer performs at the same time by way of business and on behalf of its customers one or more services related to virtual currencies and/or custodian wallet services.

Quarterly reporting to the OAM

VASPs will have to comply with certain reporting obligations to the OAM on a quarterly basis (i.e. by no later than the 15^th day after the end of each quarter). The technical modalities to discharge such obligations will be defined by the OAM.

VASPs will have to communicate to the OAM, with reference to each customer:

• the relevant identification data (surname and name, place and date of birth, place of residence, tax identification number / VAT number (if any), data of the identification document);
• the data concerning the transactions of the customer, taking into account all services performed by the VASP.

As to this latter category of data, VASPs will be required to communicate the following information in relation to each customer.

• Total balance: value of the total balance of the fiat and virtual currencies expressed in Euro as at the last day of the relevant quarter. The Euro-equivalent amount of virtual currencies will be determined on the basis of the value as at the last trading date on the platform managed by the VASP or other leading operators that the VASP uses to perform its services. The information on the total balance must be given in respect of the currencies held by the VASP with Italian or foreign entities.
• Fiat / crypto conversions: number and total value expressed in Euro of the conversion transactions from fiat to crypto (and viceversa) as at the last day of the relevant quarter.
• Crypto / crypto conversions: number of conversion transactions between cryptocurrencies.
• Crypto outflows / inflows: number of transactions determining virtual currency outflows from / inflows to the VASP.
• Fiat outflows / inflows: number and amount in Euro of the transactions determining fiat currency outflows from / inflows to the VASP, with a breakdown of cash transactions and transactions made with other payment instruments.

Access to the information by other authorities

The OAM must cooperate with the MEF, the Italian Financial Intelligence Unit, the Italian supervisory authorities, the Anti-Mafia Investigative Department, the Fiscal Police and the Anti-Mafia National Department in order to facilitate the exercise of their respective powers.

Upon request of such authorities the OAM will have to transmit any information and document held by it in connection with the management of the VASP Register, including the data transmitted by VASPs to the OAM as a result of their quarterly reporting obligations.

The police authorities identified in the VASP Decree will be entitled to bring enforcement actions against any entity that carries out services related to the use of virtual currencies or custodian wallet services in Italy illegally.

Conclusions

The VASP Decree fills a significant regulatory gap by implementing the rules on the VASP Register that were already envisaged under the Decree No. 141/2010, thereby aligning the Italian framework to the recommendations issued by the GAFI/FATF.

As the VASP Decree does not require the compliance with strict requirements for the purpose of the registration, the VASP Register will essentially be established for information and reporting purposes – pending the entry into force of the authorization requirements provided for under the MiCA Regulation proposal. From this perspective, the VASP Register will not impose significant hurdles to the performance of VASP services in Italy, as the Italian requirements are less burdensome than those applying in other EU Member State for the performance of VASP services.

All VASPs enrolled in the VASP Register will however be required to comply with the Italian AML requirements. In addition, the VASP Decree will have a significant operational impact in terms of quarterly reporting obligations of the OAM, as the compliance with such obligations might give rise to several issues from a practical standpoint.

Finally, the new rules define the scope of services triggering the registration obligations in the VASP Register in a broad and detailed manner, for instance by clarifying that such rules will apply also to those services (e.g. advice on virtual currencies) that are not expressly considered in the definitions set forth in the Italian AML Decree.

Contact us for support in enrolling in the VASP register.