Circular to VFA Agents in relation to the Application Process for VFA Service Providers

Circular to VFA Agents in relation to the Application Process for VFA Service Providers

1. Background In view of the applications that the Authority expects to receive in relation to VFA Service Providers, this circular aims to provide general guidance and outlines the application documents that are required to be submitted to the Authority by VFA Agents on behalf of prospective VFA Service Providers. Prospective applicants and VFA Agents should note that the list of documentation outlined in this circular is not exhaustive and is being provided for indicative purposes only. The Authority reserves the right to request any additional information as it deems necessary from time to time.
2. Application Process Each VFA Services licence application ( Application ) to be submitted to the Authority should contain the following list of documents:

• Covering letter to the Application

• Application Form (to be filled online) including completion of:

• Annex 1: Unitholding Structure

• Annex 2: Business Plan Synopsis

• Annex 3: Declaration Sheet 1

• Application fee

• Memorandum and Articles of Association

• Business Plan

• Organisational Structure Chart

• Three-year financial projections as required in 2.1.1(c) below

• Audited financial statements for the last three years (where applicable)

• Personal Questionnaires 2 of (i) persons having a qualifying holding in the applicant, (ii) beneficial owners, (iii) members of the Board of Administration of the applicant, (iv) Senior Managers, (v) MLROs, (vi) Compliance Officers and any other person which the Authority may deem necessary 1 Annexes 1-3 can be downloaded from the MFSA website under the VFA Service Provider tab through the following link. 2 The Personal Questionnaire as well as the relevant guidelines for the completion of Personal Questionnaires can be accessed through the following link. 14 January 2020

• Suitability Assessments 3 of (i) members of the Board of Administration of the applicant, (ii) Senior Managers, (ii) MLROs, (iv) Compliance Officers and any other person which the Authority may deem necessary

• Entity Questionnaire/s of the immediate and ultimate Qualifying Holders (in case of Qualifying Holders which are entities) and any supporting documents (including Memorandum and Articles of Association, register of members, register of directors and good standing certificate)

• Terms of Reference of internal Committees (where applicable)

• Systems/IT Audit Report4 Where documents are required to be submitted in certified true copy form, including inter alia certificates of the qualification(s) held/ courses and training attended, it should be noted that the said documents will only be accepted where they are certified by professionals such as lawyers, notaries, solicitors, auditors, accountants, medical doctors, professors and public officers not below the grade of an Executive within the Civil Service. The Authority intends to acknowledge receipt of the above documents as soon as possible. It should be noted that if any of the above-mentioned documentation is not included as part of the initial submission, the VFA Agent will be notified in a timely manner and by no later than two weeks from receipt of the Application, that the MFSA will not be in a position to commence its review process until all the requested documentation has been submitted. The Authority may, at its discretion, require additional documentation in relation to an Application. 2.1. Business Plan VFA Agents should ensure that Business Plans submitted to the Authority should as a minimum contain the following information, also in line with the Business Plan Synopsis5 requirements: 2.1.1. General Business a. Organisation Overview i. Background details about the applicant and any affiliated entities, including their respective regulatory status and previous business history; ii. Unitholding and Group Structure Diagram illustrating the relationships between the applicant and its beneficial owners/qualifying unitholders, and if part of a group, details of the other members of the group; 3 Suitability Assessments should be sent on pq@mfsa.mt or through the online Chat Box 4 The MFSA issued on 10 December 2019 the Circular to Virtual Financial Asset Service Providers in relation to Amendments to Chapter 3 of the Virtual Financial Assets Rulebook (link), which explained inter alia the Systems/IT Audit requirement, including the applicability and the associated submission timelines. 5 The Business Plan Synopsis has also been updated to reflect the revisions made to Chapter 3 of the Virtual Financial Assets Rulebook effective from 1 February 2020.

iii. Auditor (to be) appointed by the entity; iv. Systems/IT Auditor (to be) appointed by the entity; and v. Details on the applicants principal bank/s for the last three years (where applicable) b. Strategy details on business strategy, licence being applied for, type of services provided, systems to be used, target market and clients (i) number; (ii) jurisdiction; and (iii) type (i.e. experienced and/or non-experienced) c. Financials details on the applicants anticipated level of business, financial standing (audited financial statements for the last three years, if applicable) and financial projections for the first three years of operations (both realistic and optimistic, including explanatory notes). The financial projections should include: (i) the statement of financial position; (ii) statement of profit and loss and other comprehensive income; (iii) statement of changes in equity; and (iv) statement of cash flows. d. VFA Agent The Business Plan should provide for details on the applicants VFA Agent. 2.1.2. Governance The Business Plan shall outline the applicants governance arrangements, composition of the Board of Administration, Senior Management of the Company and their respective responsibilities, together with details on the internal operational structure of the applicants business including the individuals involved, roles and reporting lines. This section shall also include an Operational Structure diagram reflecting the relationships (indicating the names, reporting lines and roles) between the applicants Board of Administration, Senior Management, Compliance Function, Risk Management Function, Outsourcing Arrangements and any other key function critical for the applicants operations. Further to the above, it is imperative to note that a submission shall be deemed as incomplete where not all of the applicants key functionaries6 have been identified. 2.1.3. Risk Management This section in the Business Plan shall provide the various risks (including cyber security) that the entity will be exposed to and ways how the entity intends to mitigate such risks through its risk management policies and procedures. The Business Plan should also provide details on the person/s responsible for the risk management function and its oversight. 6 Key functionaries means those persons in relation to whom a Suitability Assessment, as outlined under Section 2 above, is required to be submitted to the Authority.

Further to the Circular to Virtual Financial Asset Service Providers in relation to Amendments to Chapter 3 of the Virtual Financial Assets Rulebook published on 10 December 2019 (link), it is noted that the appointment of an entity s Risk Manager shall be subject to the Authority s assessment of the said entity s proposed business model and, depending on the outcome thereof, the submission of a Personal Questionnaire may be required accordingly. 2.1.4. Compliance & AML/CFT This section shall identify the person who shall undertake the applicants compliance function and provide details of the applicants proposed compliance policies and procedures, including the compilation of the compliance certificate and the execution of the Financial Instrument Test in terms of R3-3.1.4.2 and R3-3.1.4.3 of the VFA Rulebook. The Business Plan shall also outline who shall be the MLRO of the entity and provide details of the applicants proposed AML/CFT policies and procedures, including details of the proposed due diligence systems, tools, processes and controls that the entity shall have in place to fulfill its obligations in terms of R3-3.1.4.4.2 of the VFA Rulebook. 2.1.5. Safeguarding of Clients Assets and Money Details shall be provided in relation to the applicants proposed custody arrangements in relation to the c and Clients Money, as well as information on the applicants policies and procedures to safeguard and reconcile and Clients Money. 2.1.6. Other Requirements This section should provide details on the Internal Audit function and by whom such function shall be carried out and supervised, Professional Indemnity Insurance, Business Continuity, Outsourcing arrangements (including the individuals responsible for the oversight of such activities) and information as to whether the applicant has or intends to enter into White Label agreements. 2.1.7. Breaches The Business Plan should provide details on the procedures for its employees to report breaches. 2.1.8. Prudential Requirements The Business Plan shall contain the following prudential requirements information:

• Own Funds and Initial Capital details on how the applicant intends to meet the initial capital requirement and how this will be structured in terms of Own Funds;

• Capital Requirement- details on how applicant intends to meet the capital requirement post authorization and how this requirement will be structured in terms of Own Funds. The applicant should also specify how it intends and what arrangements it has in place to recapitalise in cases of breaching the capital requirement.

• Internal Capital Adequacy Assessment Process (ICAAP) - details on the a proposed Internal Capital Adequacy Assessment Process policy and how these satisfy the requirements set out in the VFA Rulebook.

• Liquidity Requirement - details on the applicant proposed internal liquidity management policy and how it intends to mitigate a breach of this requirement. 2.1.9. Conduct of Business Requirements Details on the Conduct of Business requirements to be outlined in the Business Plan shall include the following:

• Conflicts of Interest details on the applicants proposed conflicts of interest policy.

• Sale Processes & Selling Practices this section should provide information in relation to the a proposed sale processes & selling practices, including details on (i) client categorisation; (ii) assessment of Clients Suitability; (iii) Complaints Handling; (iv) Execution of Clients Orders (including Order Allocation and Aggregation); and (v) Virtual Financial Assets in relation to which services may be conducted. 2.1.10. Record Keeping This section should provide details on the applicants Record Keeping & Accounting Records policies and procedures. 2.1.11. Cybersecurity This section should provide details on the applicant s cybersecurity infrastructure, including the relevant policies and procedures, as well as the person who will be responsible for this function. 2.1.12. Systems/IT Audit This section should provide details of the applicants proposed/appointed Systems/IT Auditor (as applicable)7 . 7 Further information may be found in the Circular to Virtual Financial Asset Service Providers in relation to Amendments to Chapter 3 of the Virtual Financial Assets Rulebook, which was published by the MFSA on 10 December 2019 (link).

2.1.13. Live Audit Log This section should provide details of the applicants Live Audit Log as well as the person who will be responsible for intervening in response to any request for information regarding legal compliance and the operational behaviour of the system8 . 2.2. Apostilled Documents When documentation from other countries is required, the Authority requests that passports and other identification documents are apostilled. Notwithstanding this, where a country is not a member of the Hague Convention9 , instead of apostilling, the Authority expects that documentation such as passports and police conduct certificates are legalised. 2.3. Policies and Procedures Applicants must ensure that the relevant policies and procedures are in place. For the purposes of the application, the Authority will not request the submission of the actual policies and procedures but expects to have an overview of such policies and procedures within the Business Plan as indicated in Section 2.1 above. As a minimum, and in addition to the policies and procedures that have already been identified in Section 2.1 above, the Business Plan should also include the following information (as applicable to the respective VFA Service/s being applied for):

• Best Execution (including order allocation and aggregation)
• Business Continuity
• Client Onboarding (including client categorisation)
• Conflicts of Interest
• Listing
• Outsourcing
• Personal Account Dealing
• Trade Monitoring
• Trading Framework (including procedures to reject orders, confirm relevant transactions details, define final settlement point, systems to safeguard against settlement failures and systems to monitor settlement failures) It should be noted that the Authority will be neither reviewing nor endorsing any policies and procedures during the application process. Nevertheless, and further to the requirement outlined in 2.4.2 below, it is expected that such policies and procedures are in place and available upon request during compliance visits carried out by the Authority. 8 Ibid. 9 The Hague Convention of 5 October 1961 on Abolishing the Requirement of Legalisation for Foreign Public Documents

2.4. Application Timeline Following the receipt of the full and complete Application pack, the Authority shall aim to issue its comprehensive feedback on the Application documents in a timely manner. This timeline will also take into consideration the mandatory interview with the entity s proposed Compliance Officer and MLRO and with any other proposed person as deemed necessary by the Authority. After receiving the Authority s feedback, the VFA Agent shall aim to address all the comments raised in relation to the application and provide a thorough reply to the Authority in a timely manner, whilst ensuring that the Application documents have been duly updated to reflect the same. Upon receipt and review of such additional feedback from the VFA Agent, the Authority shall then revert with any additional queries or hold a meeting with the VFA Agent if it is still not satisfied with the information provided. Once all the concerning matters have been clarified, the Authority shall then proceed to finalise its application review process and issue the in-principle approval letter whereby the Authority sets out that, in principle, it has no objection to issuing the VFA Services licence, subject to the satisfactory resolution of the [i] pre-licensing requirements; [ii] post-licensing pre-commencement of business requirements; and [iii] post-licensing post-commencement of business requirements. 2.4.1. Pre-licensing requirements Such requirements would typically include the:

• incorporation/ capitalisation of the applicant;
• submission of the finalised documents that had been submitted at application stage in draft form;
• submission of any outstanding due diligence information; and
• declaration that the applicants key functionaries identified in its Business Plan/Organisational Structure chart have been recruited. It should be noted that the pre licensing requirements should be satisfied within a maximum of three (3) months from date of the in-principle approval letter. Failure to satisfy the pre-licensing conditions would render the in-principle approval letter invalid. Once the above pre-licensing requirements are fully satisfied, the Authority would be able to proceed with the issue of the VFA Services licence, subject to the satisfactory resolution of the Post-licensing pre-commencement of business requirements and the Post-licensing post￾commencement of business requirements outlined below.

2.4.2. Issue of Licence When the Authority is satisfied that the pre-licensing requirements are met, the VFA Services licence will be issued to the applicant. 2.4.3. Post-licensing pre-commencement of business requirements Such requirements would typically include the:

• declaration by the applicants Board of Administration that the relevant policies and procedures are in place and that the relevant agreements (including inter alia outsourcing agreements) have been duly executed; and
• declaration that the employees identified in the Business Plan/Organisational Structure chart of the entity have been recruited. It should be noted that these requirements should be satisfied at pre-licensing stage by applicants who are currently operating under the transitory provision in terms of Article 62 of the Virtual Financial Assets Act (Chapter 590 Laws of Malta) ( Transitory Period ). 2.4.4. Post-licensing post-commencement of business requirements Such requirements would normally include the submission and finalisation of the applicable due diligence documentation. 2.4.5. Commencement of Business Once all the above requirements have been satisfactorily met, the Authority shall then proceed to issue the commencement of business letter to the entity. The Authority notes that this stage will not be applicable to entities operating under the Transitory Period.

3. Conclusion Interested parties should note that the VFA Service Provider Application Form as well as the Guidelines to the VFA Service Provider Application Form, will be also updated to reflect the amendments to Chapter 3 of the Virtual Financial Assets Rulebook as well as the contents of this circular. Further updates and developments on the VFA Framework will be made public on: https://www.mfsa.mt/fintech/. Queries in relation to the above should be addressed to vfa@mfsa.mt.