Circular to Virtual Financial Asset Service Providers in relation to Amendments to Chapter 3 of the Virtual Financial Assets Rulebook

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 1 Circular to Virtual Financial Asset Service Providers in relation to Amendments to Chapter 3 of the Virtual Financial Assets Rulebook On 15 October 2019, the Malta Financial Services Authority ( MFSA or Authority issued the Consultation Document on Circular to Virtual Financial Asset Service Providers in relation to System Audit Requirements ( Consultation Document ) which presented the MFSA s proposals on the Systems Audit and Live Replication Server requirements laid down in Chapter 3 of the Virtual Financial Assets Rulebook . The MFSA received several responses from industry participants and interested parties. The feedback in the said responses pertained not only to the aforementioned requirements but also to other obligations emanating from the Rulebook. Taking all feedback into consideration, the MFSA notes that certain requirements under Chapter 3 of the Rulebook may be too prescriptive for operators in this field. Therefore, and in order to support innovation in the pertinent sector, the Authority has taken the decision to revisit certain obligations, thus adopting a more principles-based approach, whilst ensuring effective investor protection, financial market integrity and financial stability. This Circular sets out the MFSA s position thereto. 1 Systems Audit Following feedback from the industry on the Consultation Document, the proposed requirements have been altered slightly so as to better ensure a fair playing field and an appropriate time for applicants to comply with the requirements set out therein. The following amendments have been made to Chapter 3 of the Rulebook to reflect the new requirements, as set out below: − The wording of Sub-Section 4, Section 1 of Title 2 has been amended; − Sub-Sections 5 and 6 have been introduced under Section 1 of Title 2; − Rules R3-3.1.6.6 and R3-3.1.6.7 have been introduced under Sub-Section 6, Section 1 of Title 3; and − Rule R3-3.5.2.1.7 has been deleted. 10 December 2019

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 2 1.1 Applicants/Licence Holders having and/or interacting with an Innovative Technology Arrangement ( ITA ) From 1 February 2020 onwards, where an applicant or Licence Holder ( LH ), as applicable: − has an ITA in place, as defined in the First Schedule to the Innovative Technology Arrangements and Services Act (Chapter 592 Laws of Malta) ( ITAS Act ), as part of its operations; and/or − operates a technological infrastructure which interacts with an ITA in some way or form, including inter alia a wallet the Authority shall require the said applicant or LH to appoint a Systems Auditor registered with the Malta Digital Innovation Authority ( in terms of Article 9 of the ITAS Act. The Systems Auditor shall be responsible for reviewing and auditing the applicants or LH s, as applicable, systems in line with the MDIA s Systems Auditor Report Guidelines, Systems Auditor Control Objectives and any other applicable guidelines, as well as the MFSA s Guidance Notes on Cyber Security, both at application stage and on an annual basis thereafter. The attention of the industry is also drawn to the definition of Systems Auditor in the Glossary, which has been amended to make reference to a Systems Auditor duly registered with the MDIA in terms of Article 9 of the ITAS Act. 1.2 Applicants/Licence Holders which do not [i] have an ITA in place as part of their operations or [ii] operate a technological infrastructure which interacts with an ITA in some way or form Where an applicant or LH, as applicable, does not [i] have an ITA in place as part of its operations or [ii] operate a technological infrastructure which interacts with an ITA in some way or form, the Authority notes that subjecting these operators to the same controls as the entities captioned under Section 1.1 above would be disproportionate. Therefore, in these instances, the Authority shall require the applicant or LH, as applicable, to carry out an IT Audit instead of a Systems Audit. The applicant or LH, as applicable, shall ensure that its IT Auditor prepares an IT Audit Report which shall be submitted to the MFSA, both at application stage and on an annual basis thereafter. The said IT Audit Report shall also include a confirmation from the IT Auditor that the applicant or LH, as applicable, does not [a] have an ITA in place as part of its operations or [b] operate a technological infrastructure which interacts with an ITA in some way or form. Further to the requirement for an IT Audit as outlined above, the Authority wishes to highlight that, where a rule makes reference to Systems Auditors, the said wording shall be amended to also make reference to IT Auditors accordingly.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 3 1.3 Additional Information In line with the Consultation Document, entities: i. operating under the transitory provision in terms of Article 62 of the Virtual Financial Assets Act (Chapter 590 Laws of Malta) ( VFA Act ) and wishing to continue providing VFA Services following the expiry of the transitory period; or ii. commencing the VFA Services Licence application process prior to 1 February 2020 shall be required to submit the first Systems Audit Report or the IT Audit Report, as applicable, within six (6) months from the granting of licence or commencement of business, whichever occurs first. All other entities shall be required to submit the first Systems Audit Report or IT Audit Report, as applicable, at application stage. 2 Live Replication Server Following feedback received in relation to the Consultation Document on the Live Replication Server, the Authority wishes to clarify that the proposed requirement should be understood in the wider sense of a machine connected to the rest of the system of an Applicant or LH, as applicable, and is not to be conflated with the live replication server requirement in terms of the current wording of R3- 3.5.2.1.6. In this regard, and being cognisant of the fact that the current terminology may cause confusion within the industry, the MFSA has replaced the term Live Replication Server with the term Live Audit Log . Accordingly, from 1 February 2020 onwards, the said Live Audit Log requirement shall be applicable to all entities falling under Sections 1.1 and 1.2 above, irrespective of where their IT infrastructure is based. The said Live Audit Log shall be required to be in line with the MDIA s Forensic Node Guidelines, which shall apply mutatis mutandis, and will further fall within the scope of the audit in terms of Section 1 of this Circular (either Systems Audit or IT Audit). Applicants or LHs, as applicable, will also be required to appoint a person with the necessary seniority, skills, knowledge and experience to ensure that any request for information regarding legal compliance and the operational behaviour of the system can be acted upon satisfactorily. The person chosen to undertake such role may engage in other roles within the entity. Furthermore, such person shall be required to be notified to the Authority. The Authority wishes to clarify that, irrespective of the existence and/or certification of an ITA by the MDIA in terms of Article 8 of the ITAS Act, the person required to be identified as outlined above shall be assuming responsibilities similar to those of the Technical Administrator, referred to in the MDIA s Forensic Node Guidelines. This notwithstanding, the Authority wishes to clarify that: i. where an ITA is not in place; or

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 4 ii. whereas an ITA is in place, same has not been certified by the MDIA in terms of Article 8 of the ITAS Act, such person shall not be required to be registered with the MDIA in terms of Article 9 of the ITAS Act as a Technical Administrator. Further to the feedback received, the Authority recognizes the need to grant additional time to existent operators in order to satisfy the said requirement. In this regard, and with reference to entities: i. operating under the transitory provision in terms of Article 62 of the VFA Act and wishing to continue providing VFA Services following the expiry of the transitory period; or ii. commencing the VFA Services Licence application process prior to 1 February 2020 the requirement to have such a Live Audit Log in place shall be imposed as a post-licensing condition. 3 Fitness and Properness Further to feedback received, the Authority understands that the wording of R3-2.2.3.1.3 is in some instances either prescriptive, thus capturing certain persons merely by virtue of the position they are proposed to hold within the prospective LH, or unclear. Being cognisant of the fact that the criterion for the triggering of the said requirement should be the actual duties of the said person/s, thus adopting a substance-over-form approach, the wording of the said rule has been amended so that Risk Managers and other persons effectively directing the VFA business of the Applicant are no longer required, by default, to undergo the Fitness and Properness Assessment. This notwithstanding, the Authority may, on a case-by-case basis, still request that other persons which it may deem necessary undergo such assessment. Furthermore, being cognisant of the fact that approved courses may not be available at all times for individuals proposed as Compliance Officers ( COs) and/or Money Laundering Reporting Officers ( MLROs), the Authority wishes to highlight that R3-2.2.3.3.4 has also been amended. As a result, the said individuals shall no longer be required to complete a course approved by the Authority prior to licensing. However, the Authority wishes to clarify that these will still be subject to the mandatory interview in terms of the said rule. Furthermore, and within the context of the competence assessment of such persons, the MFSA notes that the said individuals are still expected to have undergone training relevant to the proposed post. The Authority may, at its discretion, further decide to impose additional training as a requirement, both for the application purposes as well as on an ongoing basis thereafter. The FAQs will be amended to indicate courses that will be acceptable by the Authority for competence assessment purposes (e.g. CAMS certification for the competence assessment of proposed MLROs).

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 5 4 Exercising a European Right The section pertaining to the exercise of a European Right has been renamed Provision of VFA Services in Other Jurisdictions. LHs shall also be required to maintain a list of countries in which they are providing, or holding themselves out as providing, their services. Furthermore, following amendments to R3-2.3.4.3.3, LHs wishing to provide, or hold themselves out to provide VFA services in other jurisdictions, will no longer be required to obtain a legal opinion from a lawyer in such other jurisdiction. The Authority wishes to highlight that the LH shall be responsible for ensuring that the provision/marketing of its services is in conformity with the laws of such other jurisdiction. 5 Matters requiring Approval Pursuant to the current Rulebook, LHs are obliged to obtain the written consent of the MFSA before inter alia engaging any persons, whether Administrators, Senior Managers or other employees, who are engaged in portfolio management activities or the provision of investment advice. The said requirement for written consent in the event of occurrence of [a] above has been amended so that this shall only require the MFSA s prior notification. This notwithstanding, the Authority may, at its discretion, object to the proposed engagement. 6 Cybersecurity R3-3.1.2.1.8 required that LHs establish a cybersecurity framework, comprising a number of policies and plans. Following internal review, it was noted that the rule was too prescriptive, and it has therefore been amended. The rule has been reworded such that LHs are now required to ensure that their cybersecurity architecture is in line with inter alia any cybersecurity guidelines issued by the Authority. As a result of the amendment, R3-3.1.2.1.9 has been removed. 7 Board of Administration On the basis of feedback received, the Authority understands that the requirement for the Board of Administration to define, approve and oversee a policy on the virtual financial assets and VFA Services offered or provided in accordance with the risk tolerance of the Licence Holder and the characteristics and needs of the clients of the Licence Holder to whom they will be offered or provided , in terms of point (ii) of R3-3.1.2.2.2, is rather prescriptive and may not be applicable in all instances. In this regard, and in order to ensure that a more principles-based approach is adopted, this requirement has been removed.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 6 8 Compliance Certificate Following feedback from the industry, the Authority has decided to revise the wording of R3-3.1.4.2 so that the contents of the Compliance Certificate will be predominantly based on the Compliance Monitoring Plan carried out by the entity s CO. Compliance Certificates shall now include: i. the outcome of the CO s Compliance Monitoring Plan, including a list of breaches identified thereof; ii. a confirmation that all the local AML/CFT requirements have been satisfied, which should be obtained from the LH s MLRO; and iii. a list of Clients against which disciplinary action has been taken by the LH along with a brief description of the breach, and the actions taken by the LH. Furthermore, they Authority wishes to highlight that R3-3.2.3.14, which sets outs additional requirements in relation to the Compliance Certificate, applicable to Class 4 LHs, has been removed. 9 The Financial Instrument Test Following feedback from the industry, the Authority understands that it is not always feasible for a CO to endorse the Financial Instrument Test ( FIT ), and therefore assume such responsibility, especially where one does not have the required legal background. In this regard, the said rule has been amended so that the FIT shall now be required to be signed by the person responsible for carrying out the said test, in line with a LH s business model, and counter-signed by at least one Administrator. 10 Insurance Requirement It has been brought to the attention that the requirements laid out in R3-3.1.6.2.3, relating to Professional Indemnity Insurance, are too prescriptive. Therefore, and with the aim to adopt a more principles-based approach, the rule has been amended to read as follows: The Licence Holder shall ensure that the Professional Indemnity Insurance cover is in line with market standards and adequately covers the risks associated with the business of the Licence Holder. The notification requirements of points (vi) and (vii) of R3-3.1.6.2.5 have also been removed in light of the fact that they are effectively captured by points (ii) and (iii) of the same rule. 11 Supplementary Conditions 11.1 Scope and Application Pursuant to feedback received, it is the Authority s understanding that a Systems Auditor is not required to be present at all times but is appointed solely for the purpose of carrying out the Systems

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 7 Audit in relation to a LH s ITA. Therefore, R3-3.2.1.2, relating to the requirement to have a Systems Auditor in place at all times, has been removed accordingly. 11.2 Listing Criteria It has been noted that the recommended factors which are required to be considered when assessing the quality of a VFA, as laid out in R3-3.2.2.1.2 (previously R3-3.2.3.1.2), were deemed as prescriptive and may not be applicable at all times. For this reason, and in order to ensure that a more principles-based approach is adopted, all factors to be taken into consideration have been removed, apart from points (i) and (iv) which relate to the technological experience, track record and reputation of the issuer and its development team and the determination in accordance with the Financial Instrument Test, in line with R3-3.1.4.3 respectively, which have been maintained. The Authority is currently considering introducing further guidelines and expectations vis-à-vis listing criteria under the FAQs section on its website. 11.3 Custody The rules relating to Custody requirements have been moved to Sub-Section 5 (Safeguarding of Assets) of Section 1 of Title 3 of Chapter 3 of the Rulebook. As a result of this amendment, these requirements are now applicable to all LHs. Furthermore, R3-3.1.5.4.3 (previously R3-3.2.3.2.3) has been amended to remove the insurance requirement relating to hot storage. R3-3.1.5.4.4 (previously R3-3.2.3.2.4) has also been amended to remove reference to the requirement for LHs to retain their clients public keys, since it is understood that this modus operandi may not be applicable to every LH providing such service/s. 11.4 Suspension and removal from trading On the basis of feedback received, the Authority understands that entities may take a decision to remove or suspend a VFA from trading for various reasons, which may not always be of regulatory nature; thus, such requirement may be onerous for operators in this sector. In this regard, and in order not to unnecessarily stifle operations whilst ensuring that the objectives of financial services regulation are achieved, the notification requirement relating to the suspension or removal of a VFA from trading, emanating from R3-3.2.2.2.2 (previously R3-3.2.3.3.2), has been amended so that notification shall only be required when the suspension or removal of a VFA from trading carries regulatory implications. Furthermore, the proviso to R3-3.2.2.2.3 (previously R3-3.2.3.3.3) has been deleted. 11.5 System Resilience In order to apply a more principles-based approach to the regulation of this sector, the Authority notes that the requirement to report the parameters for halting trading and any material changes to such parameters has been removed. Furthermore, the requirement for a LH to be able to identify orders generated by algorithmic trading (R3-3.2.3.8.8) has also been removed.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 8 11.6 Bye-Laws Reference is made to R3-3.2.3.10 relating to the requirement for the LH to issue clear and transparent bye-laws. The section on bye-laws has been reworded in order to ensure that it is not overly prescriptive. The Authority is currently considering introducing further guidelines and expectations vis￾à-vis the contents of the bye-laws under the FAQs section on its website. 11.7 Inability to discharge functions R3-3.2.2.10.1 (previously R3-3.2.3.11.1) relates to the notification requirement where a LH is unable to discharge its function. It has been noted that the requirement to submit such notification on the day of such may not always be feasible, and the rule has therefore been amended to read without undue delay instead. 11.8 Disciplinary Action R3-3.2.3.12.1 related to the requirement to notify the MFSA whenever disciplinary action is taken against any of its clients. When considering the nature of the business of LHs, such requirement has been deemed too cumbersome and the Authority has therefore taken the decision to remove it. Going forward, a list of clients against which disciplinary action has been taken by the LH is to be included in the Compliance Certificate, in line with the requirements set out in R3-3.1.4.2.2. 12 Capital Requirements Pursuant to feedback received, the Authority notes that the conditions under which it may request the LH to hold additional capital, in terms of R3-3.3.4.3, are deemed as too prescriptive, and as such have thus been removed. 13 Inducement Rules During the Authority s review of the Rulebook, it was noted that the Inducements Rules set out in R3- 3.4.2.5 were only applicable to LHs providing investment advice or portfolio management. It is the A view that Inducement rules should apply across the board, as these can also have implications in the carrying out of activities such as execution of orders. The rule has been amended accordingly.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 9 14 Sale Processes and Selling Practices 14.1 General Principles Reference is made to R3-3.4.3.1.3 relating to requirements which must be adhered to for clients acting under a power of attorney. It has been noted that this requirement is too prescriptive, and the rule has therefore been removed. The Authority is also drawing the industry s attention to Part I of the FIAU s Implementing Procedures, and the requirements set out therein, in this regard. R3-3.4.3.1.4 (now R3-3.4.3.1.3) which sets out requirements relating to receipt of client money, has also been deemed too prescriptive, and the requirements have therefore been reduced. The revised rule now reads as follows: The Licence Holder shall acknowledge receipt to the Client of all money received in connection with a virtual financial asset or VFA Service and that any charge or fee imposed shall be disclosed separately. 14.2 Assessment of Appropriateness Pursuant to the feedback received, the Authority is of the understanding that the applicability of the appropriateness requirement is limited in the context of VFA business. Therefore, and in order not to stifle operations in the pertinent sector whilst ensuring that the objectives of financial services regulation are satisfied, this requirement has been replaced by R3-3.4.3.7 which reads as follows: When providing a VFA Service other than Advice or Portfolio Management, a Licence Holder shall appropriately warn clients of the risks associated with investing in VFAs through a Risk Disclosure Document. The respective sections of Sub-section 3 of Section 4 of Title 3 of Chapter 3 of the Rulebook have been amended to reflect the removal of the appropriateness assessment requirement. 15 Disclosure Requirements and Transitory Provisions It has been brought to the attention that the disclosure requirements set out in Sub-section 5 of Section 5 of Title 3 of Chapter 3 of the Rulebook are deemed as rather onerous by operators and will result in the disclosure of certain sensitive information to the general public. The Authority agrees that, in line with the principle of proportionality, whilst ensuring that the high-level principles of financial services regulation are satisfied, it suffices that such disclosures are made to the Authority instead of the public at large. For this reason, the entire section has been removed. Furthermore, Section 6 outlining requirements for entities operating under Article 62 of the VFA Act has also been removed as it has been rendered obsolete since the Transitory Period has ended.

Circular Triq l-Imdina, Zone 1 Central Business District, Birkirkara CBD 1010 +356 2144 1155 communications@mfsa.mt www.mfsa.mt 10 16 Glossary The Authority has updated the Glossary with new definitions in relation to Systems Auditor, Relevant Income and Experienced Investor. 17 Conclusion The updates included in the Circular will come into force on 1 February 2020. Further updates and developments on the VFA Framework will be made public on: https://www.mfsa.mt/fintech/virtual￾financial-assets/. Queries in relation to the above should be addressed to VFA@mfsa.mt.