Challenges to providing crypto-asset services in the EU - Oliver Zrno

Transcript

[Music] Okay. Hi everyone. Uh my name is Alexis Ivashuk. I will be taking over as a moderator for the next couple hours on this stage. And I would like to introduce Oliver Zerno. He is an associate at Finreg Partners which is a law firm that specializes in uh crypto assets, capital markets and digital operation resilience. and he will present on the challenges in EU of uh providing crypto asset services. So Oliver please go ahead with your presentation. Uh thank you. Thank you for all of you for coming and today I will I will talk to talk to you about

the uh challenging challenges to provide the crypto asset services inside of the EU. Uh I'm sure that after the uh after the last segment you're all pretty familiar with the with the Mika framework. So, we'll we'll dive into that and I'll give you the essentials on what you need to do and what you need to be doing to comply with the Mika regulation and to start providing the crypto asset services inside of the European Union. So, for for those who do not know me or us yet, my name is Oliver. I'm a junior associate at FinK Partners. We are a boutique law firm located in Prague and we focus mainly on the uh on the financial market. We provide services to to fintech companies. We

provide services to to crypto asset or future crypto asset service providers. Uh we provide our services to uh to startup companies. We provide M&A services. And we also we also acquire licenses for clients with the with the local regulator which is the Czech National Bank. Uh as I as I've already told you, I'm I'm sure that you all are familiar with the with the Mika regime. So we'll we'll we'll probably skip the the introduction to Mika since uh I I think you you all already know but to give you the the the few basic facts Mika uh is already already in force. So all of the new players that want to start providing the crypto asset services inside of the

EU they have to apply for a license. And uh the uh the regulated crypto asset services I just I just picked out a few examples. It is not all of them. There's there's some that are more rare, I'd say, that aren't as as often provided, but as an example, the uh a lot of a lot of the uh future service providers will probably provide the uh the custody and in recession of crypto assets on behalf of client, which in practice basically means that you're that you're safekeeping the uh the crypto assets of your client on their behalf. Then we have the operation of a trading platform uh which is basically a company providing a platform for their clients to trade in and to kind of uh exchange

either the uh either one or more crypto assets which can be Ethereum, Bitcoin and so on and so on. Then we have an exchange uh which is quite quite similar to the to the trading platform but uh the the exchange doesn't doesn't really happen between clients. It only happens between the company and their client and uh the the company is using their proprietary capital to uh to make the exchange with the client. Then we have execution of orders which is in practice basically a service uh when a client comes up to a company and is like okay I want you to buy me some Ethereum and you buy the Ethereum for your client that's the execution of

orders and then there's reception and transmission of orders and that is basically in practice a client coming up to you telling you sure I'd like to buy some Ethereum but uh instead of you actually buying the Ethereum on behalf of the client, you're you're transmitting the order to a third party that will make the transaction. Then there's there's portfolio management and there's providing transfer services. So portfolio management is I would say pretty self-explanatory and basically revolves around keeping up the the portfolio of your client, keeping the struct structure of the portfolio, making investments on behalf of the client. So the uh the portfolio is up to the standards that are set by the client and

the transfer services are pretty self-explanatory as well and they're basically uh they're basically just services of you transferring the crypto assets to different addresses on behalf of the client. Now we've established what the regulated services are. Now let's let's talk about the essentials on what you what you should do in order to start providing the services or prepare to get a license from the uh the local regulator. First of all, very important step, a foundation of the whole process is a solid business plan with financial forecasts. Because in order to to run a successful business, you you have to have a plan and you have to back it up by financials and the uh the regulators and the Mika itself expects the business

plan to be very precise. There's requirements for the uh for the substance of the business plan and it has to it has to reflect the future free years of provision of the services. and we'll we'll talk about the the specifics of the business plan on a on a later stage. Then there's compliance with credential requirements which is basically uh compliance with either a minimal capital amount or a uh an amount that is calculated uh based on your fixed overheads or there's insurance. Then we have a very very big very big uh step as well and that's hiring fundamental staff since the uh the mika regulation. There is a lot of there

is a lot of functions that have to happen in order to comply with the regulation and a lot of the functions they cannot be really provided by one person. So you have to have uh a lot of departments. I wouldn't say a lot but you you have to have a few departments with certain functions and the functions should be outlined very specifically so the regulator can see whether you're doing the processes right then there is a framework for internal governance internal control mechanisms which is basically just a framework of you just setting out your internal rules to be providing your services and to complying with the uh with the regulation

We'll we'll talk about the the internal governance as well on the on a later stage. So I don't think I have to explain it now. Then for for the application itself, a process has to be has to be done uh in order to ensure relevant information about the members of the management body of the company members or shareholders with qualifying holdings and members that are that will be that will be providing key functions of the company. So for example, the regulator would want to see the CVS. So the people who are in charge of of a process are suitable to be doing that process and they have they have a specific knowledge. They're trustworthy and the same the same goes to the uh to

the member of the management body itself. They have to have certain knowledge. They have to have appropriateness. They have to be trustworthy. And you have to show the regulator that you that that all the people are complying with these rules. And lastly, just submit an application with the relevant competent authority. Uh all of the all of the competent authorities are each state has one. And in the Czech Republic, for example, it's a Czech national bank. So moving on, we have the uh the business plan, which is the foundation of your business. And the business plan, as I said, should reflect at least three years in advance. So all of the things that you're describing in the business

plan, they should account for at least three years of your intended business. And for example, the key points to be uh to be described in the business plan is for example the organizational structure and the group structure. So the regulator would like to see what your internal governance is like, what your internal organization is like, what your group structure is, how the activities of other members of the group will affect yours and how the crypto asset services will affect the other group members activities and you have to describe it to the regulator.

For example, a a big part of what the what the regulator asks a lot is the the interplay and the integration of the group. So, for example, if you're going to be sharing staff, sharing hardware, software, uh sharing sharing knowhow with the with the other companies in the group that is relevant to the to the regulator. Then a lot of the u a lot of the business plan shortcomings are not very good description of the crypto asset services that will be provided. It has to be very precise, very specific. You have to you have to show to the regul regulator what services you're going to be providing, why you're going to be

providing the services, what clients are you going to be targeting, why you're going to be targeting the clients, and what channels you'll be using to target the clients. So, for example, how are you going to do marketing, what platform are you going to be using to target the clients, are you going to have a mobile app, are you going to use just just a browser interface? the regulator will want to know. And you also have to plan ahead. If you're if you're planning for example an expansion in product line, an expansion in um in marketing channels, you have to you have to describe it in the uh in the business plan. Then very important part a list of intended jurisdictions that you will

provide the services in. Uh because the uh one of the one of the Mika requirements is in order to get a license, you have to show to the regulator that you have a strong presence inside of the country that you're applying in in order to uh to eradicate the uh jurisdiction hopping that was that was mentioned in the in the previous uh in the previous panel. So the regulator has to believe or at least has to be uh has to be made aware of that you have a strong local presence and you're applying in the country that you're applying in because you want to actually provide the services there. So you will you will have to describe it in

the uh in the business plan and also if you're planning on expanding to other jurisdictions you have to you have to describe the expansion you have to you have to give reasoning to why you're expanding and you have to show the uh for example the clients you'll be targeting there why you're expanding into what countries are you expanding and I think I think we've we've already covered uh the majority of the business plan and the last part I thing it is very very crucial to outline or describe the uh what what resources you're going to be allocating to to your business what human resources what ICT resources what financial resources will

be allocated to providing the service because in order to uh to be granted a license you have to you have to have a financial human and also ICT uh background in forward to to uh provide the services safely. Then we're we're getting we're getting onto the onto the tricky part. It is the uh the fundamental staff. So let's start with the with the management body. The management body is the u the the group of people that are that are actively leading the company on a day-to-day basis or supervising its its activities. And basically there's

there's three acceptable models. There's there's one model where there's at least two members of the board of the director or two members of the management body. They are executive and then there's one supervisory body that is supervising the whole company and the actions of the of the directors. Then there's another model where uh there's basically no supervisory body and there's three directors. One of them is an executive director, one of them is a supervisory director and one of them is a substitute. Because in order to be providing the crypto asset services in compliance with Mika, you have to have at least for the for the key

functions, there should be at least people that that can jump in when someone is missing because you cannot you cannot discontin a function like that at a snap of a finger. So for example, if we're talking about the about the management body and there is only only two directors and one of them is executive and one of them is supervisory. What happens when when one of them is missing? That is why in the second scenario there is a third the substitute director that can jump in uh when it's when it's convenient. Then there is the there is a third option.

There is one executive director. there is one uh supervisory director and then there's a CEO which is not part of the board of directors and answers directly to the board of directors. So he's he's one one level below the directors. Then we have key functions. These are all the functions that are kind of hinted to or just just straight up put into put into Mika and other regulations that are that are affecting the crypto asset service providers. So for example, you have to have a department or a function that is in charge of complaint handling. You have to have a department or an employee who is charge of risk management, who is

charge of the ICT risk management because the crypto asset service providers are also affected by the digital operational resilience regulation. So they they have to they have to follow the rules of the of the ICT risk management. So they have to they have to uh have a have a person or a department that is in charge of the ICT risk management. Then we have the outsourcing officer which is basically a person or a department that is in charge of of supervising the outsourcing arrangements and the things that are being done by by third parties. Then there's a safekeeping officer. So for example, for crypto asset service

providers that are provided custody for their for their clients, there has to be a safekeeping officer who is in charge of supervising whether the uh the crypto assets of the clients are are safeguarded and are separate from the from the funds or crypto assets of the company itself. So it will prevent the company from using the crypto assets of their clients for their own account and their own own uh actions. So there has to be a safekeeping officer. Then there is a there is a quite a big part which is the IML or K KYC and basically you have to all of the all of the uh European countries they have their own

framework to tackle the the IML or KYC. So you have do you have to have a department or the appropriate amount of employees that will ensure the compliance with the AML rules. Then we have a crisis manager which is basically a department or a person that is that is ensuring that when something happens something bad happens when a risk scenario materializes there is a there is an exit plan and there is a uh there is a crisis management plan on how to tackle the situation so the business doesn't get disrupted. Then we have compliance which is basically a uh I'd say a legal support so to speak and the role of compliance is to ensure that the company

all of the activities provided by the company all of the processes done by the company are in line with with Mika with local regulation with the AML regulation uh with all the regulatory aspects possible that are affecting the actions of the of the crypto asset service provider and then there's There's obviously accounting which is just a uh a standard for for for everyday functioning of a uh of a company. And if if you just look at all the uh all the functions that are necessary from our own experience and from the experience with the check regulator, it is not really possible to successfully obtain a license when

there's less than eight people present or less less than eight uh employees present. And because there's a lot of functions that cannot really be done by the same person. So for example, the compliance function, it cannot be done by the same person as accounting. The uh the risk management cannot be done by the same person that is doing the compliance. So the functions inside of the company has to be kind of separated between the executive functions and the controlling functions.

If there is a person whose job description is to control something, he cannot be the person actually doing the job that he's controlling. Moving on to the to the big part of the application as well, it is the internal procedures and internal governance. So when I when I talk to you about all the fundamental staff, all the business plans, uh you have to you have to have procedures to be put in place, written policies that will outline on what department, what employee uh what outsourcing uh outsourcing company is doing the things that the crypto asset service provider should be doing according to regulation. So for example,

you have to have an internal policy that is describing on your AML polic or AML process, your KYC process, the client on boarding, how you're going to be reporting suspicious transactions. Then there's the complaint handling process. It has to outline who is going to be in charge of actually gathering the complaint, who is going to resolve the complaint, who is going to make changes to the company when there's a problem when when the com when the people that are actually making the complaints are right. Then there's there's uh procedures that shall be in place to ensure that the people that are doing key functions and members of the

management body that they're they're skilled enough, they're knowledgeable enough and they're trustworthy enough and the company has to keep track of why the why the specific person is really worthy of actually doing the job that they're doing. Then there's the uh there's the uh risk and crisis management policies which are just policies to describe on uh what risks you know of what uh what risk scenarios may happen to you. What you're going to do when the risk scenario materializes uh how you're going to identify the risks. What you're going to do if the

risk actually materializes what is going to be the the lesson learned from it? what changes are you going to make them? How are you going to make the changes? Who is going to be in charge of the changes? Then there's processes to comply with the uh with the credential requirements which we'll get on to in a second. So basically you have to have a written policy they will state on for example when there is a requirement of the company to to keep a minimal uh capital requirement. What is going to happen if the accounting department suddenly realizes okay we cannot we cannot really fulfill the requirement what is going to be done how you're

going to get the funds from where you're going to get the funds because in order to to actually have a license and keep it you have to you have to comply with the credential requirement at all times of of your activities then there's the u there's accounting and bookkeeping very standard for all for all companies. There's outsourcing management which will describe on how you're going to how what what functions you're going to be outsourcing, why you're going to be outsourcing them, who is going to be in charge of actually, for example, write up a a contract with with the with the outsourcing company. Who is going to be in charge of auditing the company? who

is going to be in charge of uh assessing the quality of the work that the company is doing. Then we have the provision of crypto asset services itself. A process that will describe how you're going how exactly what exact steps each department and each person inside of the company will do in order to provide the services to your clients. So for example, if we take the the example of custody, who's going to who's going to ensure that the that the crypto assets of your clients actually end up in a in a custody wallet? Who is going to be who is going to be in charge of actually keeping records on what crypto assets and whose

crypto assets are you holding? Then there's the data protection framework. uh it is very much linked to the uh either the GDPR the personal information or it is the uh data protection framework that derives from from the uh digital operational resilience act. So for example, you have to you have to ensure that all of your systems are safe enough to be transmitting data. How they're going to be set up in order to be safe enough. Who is going to determine if they're safe enough? Who is in charge of actually the the actual technical stuff?

And then there's the conflict of interest management. Uh for example, if the if the company if there's if there's a lot of people uh there is a lot of situations where conflicts of interest may arise and in in a lot of cases they can lead to to insider trading. They can lead to the breach of of uh local laws to the breach of regulatory requirements. So you have to have a policy in place that will that will ensure that you identify the conflicts of interest effectively and you will mitigate them effectively in order to minimalize their impact on the company itself. Now we're going to the we're

getting to the to the last part which may seem the easiest but is not as easy. Uh there's there's credential requirements. We have the own funds or the minimal capital funds requirement. There's a fixed overhead requirement and there's insurance inquir requirement. The the first two the the minimal funds and the fixed overheads. Uh you have to you have to keep the sum that is higher. So for example there's three tiers of own funds requirement. So the third the the the third tier uh only the uh the persons that are that are operating a trading platform will fall into the third tier and we'll have to hold a minimal minimal capital of

€150,000. Then there's a second tier which is only for the for the providers who will be providing exchange and custody and there's a there's a tier one that is that is for all the others. So for example, if your fixed overheads uh if you if you calculate 25% of fixed overheads and it is higher than the minimal requirements from your tier, you you are mandated to to keep an own funds requirement from the overheads. which means that instead of holding for example the 150,000 you're going to be holding 25% of fixed overheads uh

amount. And then there's come insurance which is basically the uh a safeguard for people who don't really don't really know how to how to keep up with the requirements. And the insurance can supplement a part or uh a certain amount of each of the requirements. So for example, you can hold just €100,000 instead of 150 and cover the rest with the insurance. And the insurance it has a very specific coverage from Mika.

uh but it is it is very hard to pass the uh the uh licensing procedure with just the insurance since a lot of European regulators they they don't really like to see the insurance being used so they prefer the the funds in themselves and now we're we're getting to the to the end of our today of our presentation today so uh thank you thank you for attending and if you have any questions you can contact us if you require legal services, you can contact us as well also. And thank you for coming.

[Applause] [Music]