I INTRODUCTION TO THE LEGAL AND REGULATORY FRAMEWORK
In 2016, when Malta had just started to hear about the blockchain boom, the country ensured that it remained at the forefront of the major changes that were heading its way in this regard in order to position itself as a prime player in blockchain developments in the European Union. The government set up a Blockchain Taskforce to help create and implement a national blockchain strategy aimed at materialising the opportunities of distributed ledger technology (DLT). This strategy eventually resulted in the publication of three new laws relevant to the sector, all published in 2018: the Virtual Financial Assets Act (VFA Act), the Innovative Technology Arrangements and Services Act, and the Malta Digital Innovation Authority Act.
Considering the size of Malta's gaming sector, it is natural to link this thriving sector to the future of DLT in Malta; Malta was a trailblazer in the gaming sector in its regulation of gaming law, creating a robust framework wherein licensees can operate in a well-regulated and flexible atmosphere. The same can also be said of the regulation of virtual currencies in Malta, as Malta is already at the forefront of such regulation.
Malta stands firmly ahead of its European counterparts with the three fully enacted pieces of legislation mentioned above on the subject of cryptocurrencies, and various stakeholders and authorities in this regard are continuing to release guidelines and interpretations to assist in the application and implementation of these new laws. The Malta Gaming Authority has issued a position on virtual currencies and their adoption within the Maltese gaming context. The Malta Financial Services Authority (MFSA) has also issued a rulebook covering the role of virtual financial asset (VFA) agents, issuers of initial coin offerings (ICOs) and providers of crypto services. It is expected that these entities will continue to issue guidance where necessary as the industry continues to develop.
II SECURITIES AND INVESTMENT LAWS
The VFA Act aims to regulate VFAs, which must be distinguished from financial instruments and virtual tokens.
The VFA Act defines the concept of a virtual token as a form of digital medium recordation whose utility, value or application is restricted solely to the acquisition of goods or services, either solely within a DLT platform on or in relation to which it was issued or within a limited network of DLT platforms. If a virtual token is or can be converted into another DLT asset type, it is treated as the DLT asset type into which it is or may be converted.
The concept of financial instruments is defined in the VFA Act as is set out in MiFID, and refers to instruments regardless of whether they are issued in Malta or not.
On the other hand, the term VFA is defined as any form of digital medium recordation that is used as a digital medium of exchange, unit of account or store of value ,and that is not electronic money, a financial instrument or a virtual token.
To offer legal clarity regarding this distinction, the MFSA created the Financial Instrument Test. The Test must be applied to each DLT asset to determine its nature and the respective applicable legal framework based on the token's features. The VFA Act provides that a DLT asset may be classified as one of these four types: electronic money, a financial instrument, a virtual token or a VFA.
Once the type of DLT asset is determined, the following legal regime will be applicable:
- virtual tokens are not regulated by any specific body of law in Malta;
- financial instruments are defined as set out in the MiFID and thus regulated by financial services legislation;
- electronic money is regulated in Malta by the Financial Institutions Act; and
- VFAs are regulated by the VFA Act.
The Test is expected to be carried out compulsorily within the context of an ICO for VFAs, referred to as an initial VFA offering (IVFAO) by the issuer and his or her VFA agent. It must also be carried out by persons providing any service or performing any activity within the context of the VFA Act or traditional financial services legislation in relation to DLT assets whose classification has not been determined. Given that the type of DLT asset may change during its lifetime, the MFSA may at any time order the conduct of the Test again to obtain an update on the determination of a DLT asset. If the DLT asset is not issued in or from Malta, the Test must be conducted before any service involving the asset is provided in Malta.
If a DLT asset, such as a securitised token, is considered to be a financial instrument by the Financial Instrument Test, then it is to be regulated by financial services legislation. In this case, rather than conducting an IVFAO or ICO, the issuer would need to conduct an initial public offering in line with the Prospectus Directive or consider the applicability of the investment crowdfunding rules.
On the other hand, if a service provider offers services in or from Malta in relation to a DLT asset that qualifies as a financial instrument, this would require a licence under the financial services legislation (typically, the Maltese Investment Services Act).
III BANKING AND MONEY TRANSMISSION
When addressing the holding of cryptocurrencies between issuer and investor during the undertaking of a VFA service, the VFA Act makes reference to wallets.
The VFA Act addresses custodian and nominee services and defines them as a VFA service licensable under the Act. Under the VFA Act, acting as a custodian or nominee holder of VFAs or private cryptographic keys, or both, or if in conducting such activities the nominee is holding such assets or keys on behalf of another person, these are considered to be VFA services.
According to the VFA Act, an issuer must provide a detailed description of the issuer's wallet or wallets used in the white paper along with a description of the 'security safeguards against cyber threats to the underlying protocol, to any off-chain activities and to any wallets used by the issuer'. The Act thus addresses security measures that are paramount to the existence and reliability of a wallet. The Act does not impose any requirements in terms of the actual technology to be used when hosting such wallets, thus ensuring the intended neutrality of the law.
Where a DLT asset is considered to be classified as electronic money, it continues to be regulated by the Financial Institutions Act and ancillary rules and regulations.
On the other hand, the provision of banking services in relation to cryptocurrencies, and more specifically VFAs, continues to be regulated by financial services legislation through the Banking Act and ancillary rules and regulations.
IV ANTI-MONEY LAUNDERING
In Malta, money laundering is criminalised primarily by means of the Prevention of Money Laundering Act and the Prevention of Money Laundering and Funding of Terrorism Regulations (PMLFTR). The PMLFTR contain detailed provisions on the measures and procedures to be maintained and applied by subject persons.
As with all new technologies, there are often hurdles that stand between advancement and stasis. Anti-money laundering could be considered to be one such hurdle in the sphere of virtual currency regulation. Concerns about money laundering and the funding of terrorism are often the rationale behind the entire banning of virtual currencies. One of the primary risks noted by the authorities, along with regulators around the globe, is the pseudo-anonymous nature of cryptocurrencies.
The Prevention of Money Laundering Act and the PMLFTR are supplemented by the Implementing Procedures issued by the Financial Intelligence Analysis Unit (FIAU). The Implementing Procedures are binding on subject persons, and failure to comply is subject to an administrative penalty.
The term subject persons is defined in the PMLFTR as 'any legal or natural person carrying out either relevant financial business or relevant activity'. The terms relevant activity and relevant financial business are further defined and, as yet, make no specific reference to virtual currencies or issuers thereof. The VFA Act therefore has extended the term subject person to also include issuers of VFAs conducting an IVFAO as well as those offering VFA services. The VFA Regulations also set out that the term includes persons who are acting under an exemption from the requirement of a VFA licence. This therefore means that the provisions of PMLFTR as well as the FIAU Implementing Procedures regulate the procedures and measures to be adopted by such persons under the VFA Act with regards to anti-money laundering and countering the funding of terrorism.
Subject persons, therefore, as defined in both the PMLFTR and the VFA Act, must take appropriate steps to identify the risks of money laundering and the funding of terrorism that could arise out of their business activities. This risk assessment must be properly documented, as the FIAU may demand such documentation.
Subject persons under the VFA Act are required to appoint and have a money laundering reporting officer (MLRO) in place at all times. The role is an onerous one, and can only be held by individuals who fully understand the extent of the responsibilities attached to that role. The MLRO must be a senior employee or a member of the board of administration.
In 2016, the European Commission proposed a fifth revision of the Anti-Money Laundering Directive. The proposal included measures that aimed to enhance the powers of the EU in the fight against money laundering, as well as to introduce safeguards in the area of virtual currencies. When the climate that was present at the time of the announcement of the revision of this Directive is taken into consideration, one might also begin to understand the rationale behind the provisions aimed to increase transparency within the EU, as well as the provisions on beneficial ownership.
One of the changes that affected the cryptocurrencies sphere was the extension of the scope of the Directive to cover both wallet providers as well as exchange service providers. Perhaps the most important change that came about through this revision was the inclusion of a definition of virtual currencies. This definition ensures that providers of exchange services and custodian wallet providers would also have to comply with the Directive.
The definition states that virtual currencies are 'a digital representation of value that is not issued or guaranteed by a central bank or a public authority, is not necessarily attached to a legally established currency, and does not possess a legal status of currency or money, but is accepted by natural or legal persons, as a means of exchange, and which can be transferred, stored and traded electronically'. This definition ensures that the concepts of electronic money and funds are entirely separate to that of virtual currencies.
The preamble to the Fifth Anti-Money Laundering Directive, which was adopted in April 2018, also provides further clarity, stating that virtual currencies may be used as a means of exchange, for investment purposes, as store-of-value products or in online casinos. An important point to note is that the Fifth Anti-Money Laundering Directive also limits itself to regulating fiat-to-crypto exchanges and not crypto-to-crypto exchanges.
V REGULATION OF EXCHANGES
The VFA Act regulates virtual exchanges established in Malta to protect investors from fraud and market abuses to combat money laundering and the financing of terrorism activities, and to ensure that exchanges operate on sound technology.
The VFA Act only allows VFAs to be admitted on VFA exchanges. Indeed, DLT assets that are qualified as financial instruments through the Financial Instrument Test must be exchanged on traditional financial markets. Virtual tokens as defined in the Act cannot be exchanged on a DLT exchange.
Operating a VFA exchange is expressly considered as one of the VFA services listed in the Act. As a VFA service provider, the operator of a VFA exchange must therefore comply with all the requirements governing the offer of a VFA service. It must therefore:
- be a legal person established in Malta;
- establish different entities if it wishes to conduct activities incompatible with its VFA licence;
- select a VFA agent approved by the MFSA to act as liaison between the exchange and the MFSA, and to ensure that the provisions of the Act are properly complied with;
- apply, through its VFA agent, and obtain a licence granted by the MFSA, and comply with the rules and regulations applicable to licence holders;
- conduct the Financial Instrument Test on all the DLT assets listed on the exchange both when admitting that asset for trading onto the exchange and when the asset changes
- circulate advertisements that are accurate and consistent;
- appoint a system auditor who may report to the MFSA any act or decision that would constitute a breach of the requirements applicable to licence holders, and to submit to the MFSA an annual report on the licence holder's systems and security access protocols;
- appoint a money laundering reporting officer who must be a senior employee of the licensee, its compliance officer or a member of the board of administration;
- appoint a compliance officer responsible for the compliance function of the exchange and for any reporting required by the MFSA Rules; and
- comply with all the relevant regulations made in application of the Act, such as the MFSA Rules.
The operator of a VFA exchange may offer other VFA services provided it holds a licence to do so. However, a VFA licence holder may not conduct other business activities requiring a licence under Maltese law unless it establishes separate entities for these activities. This segregation of activities, particularly when offering both services under the VFA Act and services under the financial services framework, is intended to better protect investors' assets.
The MFSA may require access to all information related to any asset traded on a VFA exchange. As the competent authority, it may decide or demand that a VFA exchange discontinue or suspend the trading of an asset, and even any derivative related to it, if the asset no longer complies with the definition of a VFA, if it believes or suspects that a provision of the Act has been infringed, or if the orderly transaction of business is being prevented.
The Act also regulates the advertisement of the admission of a VFA to trading on a VFA exchange. Advertisements must be clearly identifiable as such, and may not include inaccurate or misleading information. The information must also be consistent with the required contents of the white paper. Furthermore, no person other than a VFA licence holder may issue an advertisement relating to a VFA service in or from Malta unless its contents have been vetted and approved by the licence holder's board of administration.
A VFA exchange must ensure that it is equipped with effective systems of detecting possible market abuse. Any suspicion of market abuse must be reported immediately to the MFSA. This refers to instances of insider dealing, unlawful disclosure of inside information and market manipulation when dealing with VFAs.
VI REGULATION OF MINERS
The VFA Act is drafted with technology neutrality in mind, and its application is therefore not based on the way a coin is created (whether by proof of work or proof of stake). Instead, for the activity of mining a DLT asset to fall under the scope of the Maltese regulatory framework:
- the coin or asset mined must qualify as a VFA. This can be determined after carrying out the Financial Instrument Test. If the DLT asset is deemed to be a financial instrument, the financial services legislation would apply; if the DLT asset is deemed to be a virtual token, the activity in itself is considered to be unregulated; and
- the activity of mining itself must fall under one or more of the VFA services listed in the Second Schedule to the VFA Act.
Where a person is mining virtual currencies qualified as VFAs, but solely acting on his or her own account and not providing any other service qualified as a VFA service or performing any other activities in VFAs, that person may be exempt from the requirement of a VFA services licence according to the VFA Regulations. This exemption is not automatically operative, and its applicability is subject to the MFSA's determination in writing that the requested exemption applies.
On the other hand, where the mining of virtual currencies is not solely limited to dealing on own account, such as the operation of a mining farm, then in that case a VFA services licence may be required, particularly if newly issued VFAs are marketed and sold.
VII REGULATION OF ISSUERS AND SPONSORS
The VFA establishes legal definitions of numerous cryptocurrency and DLT-related concepts, offering legal certainty to business promoters and investors alike. The concept of an ininital coin offering is termed an IVFAO, which excludes the issue of a virtual token and a financial instrument.
Any person wishing to offer a VFA to the public in or from Malta, or wishing to apply for the VFA's admission to trading on a DLT exchange, must draw up a white paper in line with the Act and register it with the MFSA 10 working days before the date of its circulation in any way whatsoever. Thus, to conduct an IVFAO, it would be necessary to conduct the Financial Instrument Test to ensure that the DLT asset is in fact a VFA. The FIT is explored at length in Section II.
The issuer must be a legal person managed by at least two individuals to ensure the principle of dual control. Issuers are also required to:
- conduct their business with honesty and integrity;
- communicate with investors in a fair, clear and non-misleading manner;
- conduct their business with due skill, care and diligence;
- identify and manage any conflict of interest that may arise;
- have effective arrangements in place for the protection of investors' funds;
- have effective administrative arrangements; and
- maintain all of their systems and security access protocols to appropriate international standards.
The white paper must describe the IVFAO project in simple and informative terms, and must be registered with the MFSA as the competent authority. The MFSA may, in certain specific cases, prohibit or suspend an IVFAO.
The white paper issued for an IVFAO must include information that, according to the particular nature of the issuer and of the VFAs offered to the public, is necessary to enable investors to make an informed assessment of the prospects of the issuer, the proposed project and the features of the VFA. The white paper may not contain a condition requiring or binding an investor to waive compliance with any requirement under the VFA Act, or purporting to affect the investor with notice of any contract, document or matter not specifically referred to in the white paper. The VFA agent is required to confirm that the white paper complies with the requirements of the Act.
Before issuing an IVFAO, the issuer must also provide a copy of the audited annual accounts for the past three financial years and a confirmation by its systems auditor that its technology arrangement complies with the qualitative standards and guidelines issued by the Malta Digital Innovation Authority (MDIA), a new DLT regulator created by the government.
The Act also regulates the advertisement of any IVFAO. Such advertisement must be clearly identifiable as such, and may not include inaccurate or misleading information. The information must also be consistent with the required contents of the white paper.
VIII CRIMINAL AND CIVIL FRAUD AND ENFORCEMENT
The VFA Act, together with the Virtual Financial Asset Regulations and the ancillary MFSA Rulebooks, confer the Minister responsible for the regulation of financial services and the MFSA with powers to protect investors' interests while also overseeing the orderly transaction of business, primarily that of IVFAOs and VFA service providers.
Issuers of VFAs are liable for damages sustained by a person as a direct consequence of such person having bought VFAs, either as part of an IVFAO by the issuer or on a DLT exchange, on the basis of any false information contained in a white paper, on a website or in an advertisement. A statement included in a white paper, on a website or in an advertisement is deemed to be untrue if it is misleading or otherwise inaccurate or inconsistent, either wilfully or in consequence of gross negligence, in the form and context in which it is included.
The MFSA may suspend or terminate the trading of a VFA if this is in the interest of the VFA exchange, investors or the general public. Conversely, to avoid causing significant damage to investors' interests or the orderly functioning of a VFA exchange, such VFA exchange may suspend or remove from trading a VFA that no longer complies with the definition of a VFA or the by-laws of the VFA exchange.
The MFSA may impose unilateral decisions on any issuer of an IVFAO, and on any VFA agent or VFA service provider. It is thus empowered to:
- request information from any person;
- order the review of the determination of a DLT asset and submit this determination to a test;
- appoint inspectors to investigate and report on the activities of an issuer, VFA agent or VFA service provider;
- order an issuer or service provider to cease operations or appoint a person to advise him or her, take charge of his or her assets, or even control his or her business;
- order the suspension or the discontinuation of the trading of a VFA; and
- impose administrative penalties.
Where a VFA licence holder, or the secretary, a member of the board of administration or any other person responsible for a licence holder, contravenes or fails to comply with any of the licence conditions, or he or she is deemed to be in breach of the VFA Act, regulations or rules, including through a failure to cooperate in an investigation, the MFSA may impose an administrative penalty of up to €150,000 by notice in writing and without recourse to a court hearing.
In the public interest, most decisions made by the competent authority are subject to appeal in front of the Financial Services Tribunal.
The VFA Act does not put in place any specific tax regime in relation to cryptocurrencies, and more specifically VFAs. However, the Act provides that regulations may be drawn up by the responsible minister to address certain tax matters, thus allowing for further regulation outside of the main Act. For instance, a minister can issue regulations in order to be able to organise compensation schemes for investments, and those schemes are exempt from the payment of income tax as from the date of establishment of such schemes.
Furthermore, taxation is also referred to in the First Schedule of the Act, whereby reference is made to the information required when drawing up a white paper to offer a VFA. Any applicable tax that might apply to a VFA intended to be offered is to be included in the white paper.
With the eventual coming into force of the VFA Act and the development of this new legal framework, the Maltese Inland Revenue Department is expected to issue guidance on the taxation of virtual currencies. It also remains to be seen whether the eventual taxation of cryptocurrencies in their mining stage or of miners will take place, and how profits made from such activities are to be taxed.
X OTHER ISSUES
The VFA Act does not only seek to regulate the roles of issuers and exchanges. Schedule 2 to the VFA Act refers to other services that, when provided in relation to VFAs, constitute a licensable activity under the Act. This includes:
- the receipt and transmission of orders;
- the execution of orders on behalf of other persons;
- dealing on own account;
- portfolio management;
- custodian and nominee services;
- investment advice; and
- the placing of VFAs.
Following the entry into force of the Act, these activities require a licence to operate in or from Malta, and must comply with the ongoing obligations set out in the Act.
The accompanying Regulations to the Act and the MFSA Rules contain detailed provisions on the licensing requirements for VFA service providers and the licensing process.
The Regulations provide for four classes of licences, each having varying minimum capital requirements.
Except in the case of the provision of investment advice, VFA service providers must be set up as a legal person managed by at least two individuals to ensure the principle of dual control. They must appoint a money laundering reporting officer and a compliance officer. The service provider may also be required to appoint a systems auditor in relation to its innovative technology arrangement. The service provider must also establish a cybersecurity framework, maintain adequate risk management policies and procedures, safeguard clients' rights in relation to virtual financial assets and money, and keep records of all its services and transactions.
The VFA Act also regulates the role of the VFA agent who is responsible for representing a licensee before the MFSA, and who is acting as a liaison between the authority and the operator. An issuer of VFAs or any VFA service provider seeking licensing or authorisation under the Maltese regime is required to appoint a local VFA agent to apply on his or her behalf.
The VFA agent assists the issuer in conducting the Financial Instrument Test on a DLT asset, and must confirm to the authority that the white paper complies with the requirements of the Act. The VFA agent is required to advise and guide the issuer as to its responsibilities and obligations under the Act, while also ensuring compliance with such provisions. The VFA agent must also receive and retain all documentation and information to demonstrate how, and to what extent, the issuer has satisfied the requirements prescribed in the Act and of any ancillary rules or regulations insofar as they apply to any offer or admission to trading. This includes ensuring that the issuer is considered to be a fit and proper person to carry out such activities, and demonstrating how the issuer has complied and, as far as it can be determined, will comply with its continuing obligations under the Act.
An application for a VFA services licence may only be done through a VFA agent. The VFA agent is required, diligently and with utmost good faith, to submit full and correct information whenever it is required to do so; and to support the MFSA in carrying out its reviews to establish that the applicant is a fit and proper person to provide the VFA service, that it has a good reputation, that it is competent and solvent, and that it will comply with and observe the requirements of the Act, and any regulations made and rules issued thereunder and that are applicable to it.
The government has also created a new DLT regulator, the MDIA. The MDIA will be tasked with issuing certifications for innovative technology arrangements, which are primarily regulated under the Innovative Technology Arrangements and Services Act.
XI LOOKING AHEAD
The VFA Act and ancillary regulations and rules were drafted with technology neutrality in mind to be able to keep abreast with technological advancements in this field. As Malta begins to regulate virtual currency-related activities in practice through its licensing regime, the regulator will undoubtedly respond to the industry's requirements, and assess the efficiency and applicability of the legal regime to consider any possible amendments for its improvement.
1 Ian Gauci is a partner, Cherise Abela Grech is an associate and Bernice Saliba and Samuel Gandin are junior associates at GTG Advocates.