Germany’s Approach to Crypto-assets and their Safeguarding Under 5MLD and Financial Regulation

Crypto and money laundering regulation

5MLD is EU legislation that had to be implemented by EU Member States by 10 January 2020 and that calls for stricter rules to combat money laundering. Among other things, Member States are required to include crypto asset traders and crypto wallet providers within the ambit of parties who are subject to anti-money laundering obligations (e.g., identifying customers, monitoring client relationships for signs of money laundering, making suspicious activity reports, etc.).

Under 5MLD, providers of exchange services between virtual and fiat currencies and custodian wallet providers are to be registered. Germany has not created new categories of obliged persons under its Money Laundering Act but has instead chosen a different way of implementing 5MLD by including:

• A definition of crypto assets in its Banking Act.
• Crypto assets in the definition of financial instruments.
• A new financial service that is subject to regulation under the Banking Act, namely, the activity of “crypto safekeeping,” which is defined as the safekeeping, management and safeguarding of crypto assets for others or the safekeeping, management and safeguarding of private cryptographic keys that serve to hold crypto assets, store or transfer them.

It should be noted that the definition of crypto assets is broader than under 5MLD, which covers only the safeguarding of keys, not the safeguarding of crypto assets themselves.

As a result of these minimal changes, persons engaged in the activities below are treated as financial services providers and, consequently, are subject not only to a registration requirement as prescribed by 5MLD but also to a licensing requirement. As a result of having become financial services providers under the new rules in the Banking Act, providers related to crypto assets became regulated (to the extent they were not already regulated under BaFin’s financial services remit) and, as such, are obliged persons under the Money Laundering Act.

The following parties are therefore subject to regulation and supervision by BaFin as regards crypto assets:

• Brokers/dealers
• Advisers
• Portfolio managers
• Underwriters
• Placement agents
• Wallet providers
• Custodians of private keys to access the wallets

At the same time, any doubt that might have remained about whether cryptocurrencies are financial instruments for the purposes of the Banking Act have been resolved.

It should also be noted that 5MLD requires the registration of traders of crypto only against fiat currencies, not traders of crypto against cryptocurrencies. In Germany, the license requirement also covers crypto/crypto trading. The UK and other countries, in line with advice from the Financial Action Task Force, have taken a similar approach to imposing such super-equivalent provisions.

“Crypto assets” are defined as digital representations of value that are not issued or guaranteed by a central bank or a public authority, are not necessarily attached to a legally established currency and do not possess a legal status of currency or money, but are accepted by natural or legal persons as a means of exchange that can be transferred, stored and traded electronically or serve investment purposes other than e-money or a monetary value used in limited networks for certain exempt electronic payments processed by telecommunication providers.

Notably, the words “or serves investment purposes” have been added to the definition in comparison to the original definition of virtual currencies in 5MLD. In addition, BaFin has stated repeatedly that it considers transferable digital tokens that represent membership of a company or a financial claim to be securities, that is, a financial instrument. Consequently, all sorts of tokens, except true utility tokens (e.g., digital vouchers for future services), are financial instruments and the above-mentioned activities are regulated activities. Interestingly, there is still a distinction between virtual currencies and tokens that are virtual securities, in so far as the former are not subject to conduct of business and prudential regulation under the German Securities Trading Act, which transposes the EU Markets in Financial Instruments Directive (or MiFID2). This is because the definition of “financial instrument” in the Securities Trading Act is narrower than in the Banking Act. Consequently, for example, best execution obligations will apply only to asset and securities tokens, not to virtual currencies (e.g., payment tokens) or utility tokens.

Crypto and safeguarding

As for duties around the safeguarding of crypto, there has been a debate around whether crypto guarding should be compatible with other financial services. The German legislature has decided that crypto safeguarding is compatible with other financial services — in other words, crypto traders and brokers can offer an additional service to hold crypto in their wallets on behalf of customers or to safeguard and administer the private keys that open the customer’s wallet. It remains the case that holders of tokens can create their own wallets and store private keys in any manner they deem fit and even professional parties holding crypto for themselves are not required to use a third-party custodian. However, holding crypto or keys/wallets for others would require an additional license or the use of a duly licensed third party.

These rules apply to virtual currencies. Arguably, to hold an asset token/security token, a normal custody license would be required, since these types of tokens are securities within the meaning of the Banking Act (and the Securities Trading Act). Any German investment fund investing in tokens would have to appoint a depositary, which would need to have a license for the safeguarding of crypto assets should the fund invest in virtual currencies, or hold a normal license for custody business in order to hold an asset/security token. A pure utility token will fall outside any regulatory regime.

Crypto and reverse solicitation

Under reverse solicitation, an offshore business can operate without triggering a licensing requirement in a particular country. There is no specific regulation in Germany in relation to crypto assets. For all banking and financial services, the rule is the same.

• German companies carrying on regulated activities need a license in Germany, even if all their customers reside outside Germany and regardless of whether the customers were solicited or made a reverse inquiry.
• Non-German companies that provide regulated services to German customers will only fall under the German regulatory regime if they have actively solicited customers in Germany. Responding to reverse inquiries does not trigger a licensing requirement. Where German clients have responded to internet offerings, it is a matter of judgment whether German regulation is triggered. In this respect, offerors should avoid using German language, giving German phone numbers or other German contact details and making statements explicitly addressed to German investors.