ITALY TO ENHANCE AML/CFT RULES ON CRYPTO-ASSETS SERVICE PROVIDERS

Abstract

On February 17, 2022, the Decree by Ministry of Economy and Finance dated January 13, 2022 (the “Decree”) introducing obligations for crypto-assets^[1] providers of services supplied in Italy was released on the Official Journal of the Italian Republic^[2].

Pursuant to the Decree, these service providers must satisfy certain conditions and timely request to be enrolled into a Register (the “Register”) kept by the Italian competent authority (OAM, Organismo Agenti e Mediatori)^[3], otherwise their activity might be considered unlawful and administrative penalties be inflicted.

The new Italian measure attempts to align domestic legislation to the ongoing European Union policy on Anti-Money Laundering/Countering Terrorism Financing (AML/CTF).

Though the Decree pursues monitoring purposes only – therefore, apparently does not pose material requirements – it may nonetheless hurdle crypto-assets providers of services operating as a legal entity – rather than individual – in one or more EU countries other than Italy. Some doubts arise on effectiveness of these new rules in view of the coordination and fine-tunings that might be necessary once the European Regulation on Market in Crypto-Assets (MiCA)^[4] is approved.

The Decree is effective by February 18, 2022. 

Background

Today’s crypto-assets market capitalization fed by around 8 million transactions^[5] is reported worth roughly $2 trillion^[6].

This is one of the expected effects triggered by a pervasive adoption of the Distributed Ledger Technology (DLT) and the blockchain – the cutting-edge technological concept behind cryptocurrencies such as Bitcoin and Ethereum – which claim the potential to replicate the traditional financial system by Decentralised Finance (or ‘DeFi’).

There are three central points worth noting about this global phenomenon. First, it primarily serves to issue private (virtual) currencies usually convertible into legal tender (so called “fiat”) through exchange marketplaces. Second, it may cover anonymous transfers of funds. Third, it is a largely unregulated environment.

This landscape is equally at the source of curiosity^{[7] [8]} and concern within the EU. Therefore, policy makers are monitoring developments closely and will eventually take action to mitigate emerging money laundering (ML) patterns and terrorism financing (TF) risks.

According to EU studies^[9], the key issue that needs to be addressed in the fight against ML and TF via cryptocurrencies is the anonymity surrounding them, which the existing European legal framework fails to appropriately deal with.

At least at EU level, the fight against ML and TF focuses on the illicit use of cryptocurrencies, not on DLT and blockchain technologies themselves.

The AML/CTF EU legal framework and the EU response to challenges arising from cryptocurrencies

A material downside of criptocoins is that they often serve as a financial enabler to a multitude of illegal and disreputable purposes facilitated by freedom of capital movement within the Union’s integrated financial area and leading to ML and TF^{[10] [11]}.

Frequently carried out as they are in an international context, these illegal activities pose a serious threat to the integrity of the EU economy, the financial system, and the security of European citizens^[12].

In light of the specific AML/CTF vulnerabilities that have been witnessed in the crypto-assets service providing industry, the Financial Action Task Force (FATF) – the global ML and TF watchdog – recommended^[13] the EU policy makers to evaluate broadening the existing legislation to embrace crypto-assets service providers so to facilitate their traceability and to enable exchange of information among appropriate authorities.

To these ends, the EU Parliament revised substantially, among others, the following legislation:

• Directive (EU) 2015/849 on preventing the use of the financial system for money laundering or terrorist financing (4^th anti-money laundering Directive, AMLD)^[14];
• Regulation (EU) 2015/847 on information on the payer accompanying transfers of funds, which makes fund transfers more transparent, thereby helping law enforcement authorities to track down terrorists and criminals^[15].

The 4^th AMLD has been amended by Directive (EU) 2018/843^[16] (the 5^th AMLD) to better equip the Union with tolls to prevent the financial system from being used for ML and for TF activities related to virtual currencies and wallet providers. Changes essentially limit the anonymity behind cryptocurrencies transactions^[17]. In this perspective the 5^th AMLD includes a definition of virtual currencies and in-scope services, customer due diligence and the duty to report suspicious transactions to Financial Intelligence Units (FIUs). Thereafter, the 4^th AMLD has been complemented and reinforced by Directive (EU) 2018/1673 (the 6^th AMLD) aimed at giving financial institutions and authorities yet more tools to tackle ML and FT by further widening its scope, clarifying certain regulatory details, and tightening criminal sanctions across the EU.

As Regulation (EU) 2015/847 only applies to transfer of funds, meaning of banknotes and coins, scriptural money and electronic money^[18], it was felt appropriate to extend its scope to also cover transfers of virtual assets and the traceability of transfers of funds and crypto-assets.

To these purposes, the EU Council elaborated a proposal^[19] and agreed on a mandate^[20] to negotiate with the European Parliament to update existing rules on information accompanying transfers of crypto-assets and recasting Regulation (EU) 2015/847. The proposal seeks to introduce an obligation for in-scope service providers to collect and make accessible full information about the sender and beneficiary of transfers of virtual or crypto assets, which is what payment service providers currently do for wire transfers. The objective is to ensure the traceability of crypto-asset transfers in order to identify suspicious transactions and, if necessary, blocking them. Moreover, the modifications streamline and clarify the Commission’s proposal, in particular by introducing requirements for crypto-asset transfers between crypto-asset service providers and un-hosted wallets ^[21] as well as to align existing legislation to the MiCA Regulation.

The proposal is part of a package of legislative proposals to strengthen the EU’s AML/CFT rules, presented by the Commission on 20 July 2021 along the lines of the EU Commission Action Plan of 7 May 2020, encompassing:

• a Regulation on the prevention of the use of the financial system for purposes of ML and TF^[22];
• a Directive establishing the mechanisms that Member States should put in place to prevent the use of the financial system for ML/TF purposes, and repealing Directive (EU) 2015/849^[23];
• a Regulation creating an EU Authority for AML and CTF (‘AMLA’)^[24].

OVERVIEW OF THE ITALIAN DECREE ON CRYPTO-ASSETS SERVICES PROVIDERS

The Italian Decree implements provisions set forth by the Legislative Decree no. 90/2017 and by the Legislative Decree no. 125/2019^[25] to align Italian AML/CTF legislations on virtual currencies services providers to Directive (EU) 2015/849 and Regulation (EU) 2015/847 as amended from time to time.

The new rules basically introduce two obligations to in-scope services providers to lawfully perform their activity in Italy. First, they are requested to be enrolled in a Register. Second, they shall accomplish certain Reporting obligations.

In-scope services

The Decree applies to providers of services regarding “virtual currencies”, including e-wallet providers, that carry out their activities in Italy.

The new measures provide for a quite wide definition of its object and relevant players.

According to the Decree, the virtual currency is any digital representation of value, neither issued nor backed by central banks or public authorities, nor necessarily underlying legal tender (Fiat), that is used to purchase goods and/or services or as an investment, and that is transferred, stored, and traded electronically^[26].

Furthermore, the Decree identifies as eligible service providers either individuals or entities providing on a professional basis to an unrelated party, even on-line, one or more of the following services:

• services for using, exchanging, storing, converting virtual currencies or digital representations of value;
• services to release or offer virtual currencies;
• services to transfer and set-off virtual currencies;
• any other service ancillary to purchasing, trading or intermediating the exchange of virtual currencies;
• e-wallet services involving safe storage of cryptographic keys on behalf of customers.

From the plain reading of the Decree, it is doubtful whether the mere issuance of virtual currencies itself falls within its scope even where the issuer does not perform in parallel one or more in-scope services.

The Register and the compulsory enrollment for in-scope services providers

Pursuant to the Decree, the OAM should set up within May 19, 2022 a section of the Register currently established for money exchangers ^[27] to also include in-scope activities of crypto-assets providers.

This section of the Register will include, inter alia, the following information about in-scope service providers:

• identification details;
• tax ID or VAT number (if any);
• the type of services rendered to customers;
• address of the business activity (including any ATMs), and/or the web address for on-line services providers.

The inclusion in the Register is an essential condition that legitimates in-scope service activities in Italy, whose satisfaction varies depending on the nature of in-scope service providers^[28]:

• Individuals must have Italian or European citizenship or must otherwise be compliant with immigration laws
• Legal entities must have their legal and administrative seats in Italy or, in case of EU entities, an Italian branch (stabile organizzazione).

A communication must timely be filed electronically with OAM by in-scope service providers and those who are already running in-scope activities in Italy, within July 18, 2022.

The OAM will assess whether the in-scope provider satisfies the mentioned requirements and it may approve or reject applications for registration within 15 days from the date of filing.

Reporting obligations

In-scope service providers must file, on a quarterly basis, a report showing, among others, customer personal data such as surname and name, place and date of birth, place of residence, tax identification number / VAT number (if any), reference of the ID.

Additionally, they have to report data on transactions involving each customer including all services performed such as their balance, the number and value of transactions flows e.g. fiat-to-crypto or crypto-to-fiat, crypto-to-crypto.

Based on input data received from in-scope service providers, the OAM will cooperate with other Italian authorities (e.g. the MEF, the Italian Financial Intelligence Unit, the Bank of Italy, the Tax Police, etc.).

Under certain conditions, in-scope service providers may be obliged to also report cross-border virtual currency transactions equal to or exceeding € 15.000 to the competent tax authorities^[29].

Penalties

Should in-scope service providers fail to enroll with in the Register, their activities may be held abusive by the authorities which may inflict administrative penalties ranging from € 2.065 to € 10.329.

Ordinary administrative sanctions apply to other violations, such as of reporting obligations. Severe repeated violations of the ordinary AML/CTF rules may result in the cancellation of the ability to carry out activities in Italy.

Preliminary Comments

The new statutory obligations might significantly impact legal entities carrying out in-scope services, in one or more EU country other than Italy. Higher administrative burden would be suffered by in-scope service providers that do not meet the minimum presence within Italy (a Permanent Establishment) to be enrolled in the Registry (so-called proxy requirement).

However, this proxy requirement -implying at least assets/employees in Italy – may raises doubts.

The requirement was designed for money exchangers, with tangible offices/employees and tangible money to exchange; therefore, it appears relatively excessive burden to fully digitalized service providers such as those under discussion. In other words, this requirement seems to exceed what is necessary to achieve the objectives of the Decree, which is monitoring cryptocurrencies transactions and countering ML and TF.

Moreover, given the upcoming approval of the MiCA Regulation, as part of the widen Digital Finance package developed at EU level, conflicts may arise between the authorization requirements set forth under the MiCA and the Italian rules.

Least but not least, the compulsory establishment in Italy may trigger domestic tax obligations and liabilities upon in-scope services providers which, from a number of perspectives, may be inconsistent with international and domestic tax principles.

Download Article

---