Circular on the Publication of the Virtual Financial Assets Rules for Issuers of VFAs

Page 1 of 4

CIRCULAR

PUBLICATION OF THE VIRTUAL FINANCIAL ASSETS RULES FOR ISSUERS OF VFAs

1. Background The MFSA has today published Chapter 2 of the Virtual Financial Assets Rulebook: Virtual Financial Assets Rules for Issuers of VFAs. The publication of the rules applicable to Issuers of Virtual Financial Assets (‘VFAs’) follows two main consultations, namely: [i] Consultation Paper on the Virtual Financial Assets Rules for Issuers of Virtual Financial Assets; and [ii] Consultation Paper on achieving a Higher Degree of Investor Protection under the Virtual Financial Assets Act, that were issued on 30 July 2018 and 21 August 2018, respectively. This Chapter shall apply to Issuers of Virtual Financial Assets (‘Issuers’) in terms of the Virtual Financial Assets Act (‘the Act’). It shall also apply to VFA Agents in so far as the particular rule refers to such Agents.

2. Risk Factors Failure, fraud and money-laundering through crypto-assets is a concern for financial services regulators internationally. 1 Fraudsters have used unregulated environment around Initial Coin Offerings (‘ICOs’) to exploit often uneducated and unprotected victims.2 During November 2017, ESMA alerted investors to the high risks of ICOs highlighting that ICOs are vulnerable to illicit activities with several ICOs having been identified as frauds; some ICOs may also be used for money laundering purposes; high risk of losing all of the invested capital; as well as lack of exit options and extreme price volatility.3

1 See: [ESMA50-157-829] https://www.esma.europa.eu/sites/default/files/library/esma22-106-1338_smsg_advice_- _report_on_icos_and_crypto-assets.pdf 2 See: Virtual currencies and terrorist financing: assessing the risks and evaluating responses, Counter-terrorism, Directorate General for Internal Policies of the Union, PE 604.970 – May 2018, European Parliament, Pg 45 3 See: https://www.esma.europa.eu/sites/default/files/library/esma50-157-829_ico_statement_investors.pdf

Page 2 of 4 3. MFSA Approach Regulation safeguarding market integrity and protecting consumers of financial services is crucial for market confidence. As a result, and in line with the functions of the Authority as set out in the Malta Financial Services Authority Act (Chapter 330 of the Laws of Malta), the MFSA has adopted a set of rules applicable in the context of Initial VFA Offerings which address the risks inherent in the ICO space through requirements on: i. Governance The rules place a number of responsibilities on the Issuer’s Board of Administration who are ultimately responsible for ensuring that the Issuer complies with its obligations, including the AML/CFT requirements. Furthermore, the Rules also require an Issuer to appoint and have in place at all times the following functionaries: [i] a Systems Auditor (where applicable); [ii] a VFA Agent; [iii] a Custodian; [iv] an Auditor; and [v] a Money Laundering Reporting Officer (‘MLRO’). ii. Investor Protection In the Consultation Paper on achieving a higher degree of investor protection under the Virtual Financial Assets Act, the Authority proposed: [i] the appointment of an independent custodian; [ii] the monitoring of milestones; and [iii] a maximum investment limit for retail customers. The Authority has carefully considered all feedback received and has inter alia adopted the following Rules:

• The appointment of an independent custodian The rules, as amended, require an Issuer to appoint an independent third party to act as Custodian for the safekeeping of its assets and investors’ funds. With respect to VFAs, the Issuer may appoint a third party who either: [i] holds a licence under the Act to provide custodian or nominee services, or is exempt from licensing under regulation 4(1)(o) of the Virtual Financial Assets Regulations4 ; or [ii] is constituted in a recognised jurisdiction, provided that the Issuer discloses to its clients and to the Authority, the arrangements that will be put in place to ensure adequate safekeeping of assets. With respect to fiat currencies, with [i] a central bank; [ii] a credit institution authorised in accordance with the provisions of Directive 2013/36/EU; [iii] a bank authorised in a third country; [iv] a money market fund; [v] an electronic money institution; or [vi] a payment institution. It should be emphasised that monies placed with electronic money institutions or payment institutions can only be placed with such institutions for purposes encompassed by their respective licences under the Financial Institutions Act. Furthermore, the custody of VFAs may be performed through the use of an Innovative Technology Arrangement (a smart contract) which is duly certified by a Systems Auditor.

4 a person providing custodian or nominee services in terms of paragraph 5 of the Second Schedule to the Act who is authorised in terms of article 43(3) of the Trusts and Trustees Act to act as a trustee, provided that such person does not provide any other service in terms of the Second Schedule to the Act. (This exemption is not automatically operative but its applicability shall be subject to the determination in writing by the MFSA)

Page 3 of 4

• Monitoring of milestones The rulebook requires Issuers to provide investors with regular and comprehensive updates on the progress being achieved with respect to the milestones set out in the white paper to enable investors to assess the deliverables in the white paper. Such updates are to be made by means of public announcements. In the event of the milestones not being met, this must be stated in the public announcement and should the delays potentially affect the risk parameters of the project, the issuer would need to update the white paper accordingly and inform investors of their right to opt out.
• Maximum investment limit

A rule stating that the issuer shall ensure that an investor does not invest more than EUR 5,000 in its Initial VFA Offerings over a 12-month period shall be included. The rule also contains a proviso stating that this requirement shall not apply to Experienced Investors. An Experienced investor is defined in the glossary as being “a person who declares to the Issuer that: [i] he is capable of providing evidence that he has already participated in other Initial Virtual Financial Asset Offerings and his initial investment exceeded EUR 10,000 or its equivalent; [ii] he is aware of the risks involved; and [iii] the funds he is contributing to the specific Initial Virtual Financial Asset Offerings does not exceed one per cent of his net worth excluding his main residential home.” iii. Anti-Money Laundering Notwithstanding that under the Act, Issuers are considered as subject persons for purposes of the PMLFTR, Chapter 2 of the VFA Rulebook also imposes a number of requirements related to AML/CFT as follows:

• An annual compliance certificate Such certificate shall be drawn up by the Issuer, reviewed by the VFA Agent, which VFA Agent is required to ensure its completeness and accuracy, and signed by all members of the Issuer’s Board of Administration and subsequently submitted to the Authority by the VFA Agent. The Compliance certificate must inter alia contain a confirmation that all the local AML/CFT requirements have been satisfied and that the Issuer has adequate systems in place to identify suspicious transactions and to draw up suspicious transaction reports, which confirmation should be obtained from the Issuer’s MLRO;
• An annual AML/CFT Report Issuers are to engage an independent auditor to draw up a report which includes a: [i] confirmation that the AML/CFT/KYC systems the Issuer purports to have in place are indeed in place; and [ii] review of the operations of the Issuer from an AML/CFT perspective.

Page 4 of 4 Furthermore, the MFSA will not be accepting applications by an Issuer who does not demonstrate and provide reasonable assurance to the satisfaction of the Authority that it has appropriate systems in place to satisfy its AML/CFT requirements. iv. Transitory Provisions Issuers benefitting from the transitory provisions provided under Article 62 of the Act shall, in so far as applicable, comply with the applicable VFA Rules on a best efforts basis. Such Issuer shall be required to: [i] engage the services of a person who: (a) is registered as a VFA Agent in accordance with Article 7 of the Act; or (b) has the intention to apply for registration as a VFA Agent in accordance with Article 7 of the Act, provided that such entity has at least two proposed Designated Persons who have successfully completed a course approved by the Authority; [ii] immediately provide the Authority with a copy of the Financial Instrument Test of the respective Virtual Financial Asset which is duly signed by the service provider specified in point [i]; [iii] provide evidence to the Authority that it has successfully passed a fitness and properness assessment, conducted by the service provider specified in point [i], in terms of Chapter 1 of the VFA Rulebook; and [iv] provide evidence to the Authority that it has appropriate systems in place to satisfy the AML/CFT requirements applicable to Issuers.

4. Queries on whitelisting and the definition of “offer of virtual financial assets to the public” In view of the numerous queries received by the Authority on the definition of “offer of virtual financial assets to the public”, the industry is hereby informed that the said definition shall be included in the Glossary of Terms to be issued by the Authority over the course of the coming days. The said definition shall also include any exemptions therefrom. The Authority further wishes to note that the pertinent sections under the Frequently Asked Questions on the Virtual Financial Assets Framework shall be updated accordingly to also encompass certain scenarios addressed to the Authority, including inter alia whitelisting and Simple Agreements for Future Tokens, as well as the Authority’s interpretation in relation thereto. Further updates and developments on the Virtual Financial Assets Framework will be made public on: www.mfsa.com.mt/vfa. Communications Unit 30 October 2018