First Pioneers of Regulated Crypto Business: Lessons Learned and Avoiding Future Compliance Headaches

Transcript

All right. Uh hello everyone. Uh thank you for coming. Uh as as our colleague mentioned uh we will cover a lot of the uh legal stuff which might be boring for you. So I'll I'll try not to bore you to death today. And uh as as you all know uh well we'll be talking about the first pioneers of regulated crypto business. So I want to talk especially about the uh crypto asset service providers because the uh the transitional period is about to end and a lot of the uh providers already received their their licenses and there were many uh lessons learned throughout the journey and uh we'll we'll talk about it today. So for those who do not know me or our law firm

uh we are finick partners. We're based out of Prague and we specialize in fintech, financial innovation, capital markets, mergers and acquisitions and especially uh the licensing procedures uh before the Czech National Bank which is the local regulator. So let's uh let's jump straight in. uh the amount of applications that were uh that were received by the competent authorities in in the European Union uh there was a huge number and most notably in the Czech Republic uh a lot of the uh foreign providers seek this jurisdiction and the Czech national bank they received 258

applications uh for the uh for the grandfathering period and so far they've only granted six of them which is a very low acceptance rate and my personal opinion is that before the transitional period uh will end we will see maybe 8 to 10 applicants in total. So uh the standard is very high and it is very hard to meet all the requirements of the regulators. So uh what is the uh what is the main reason why the uh the applicants are failing and a lot of the time it is pretty straightforward. So for example there is this thing called

jurisdiction hopping which is basically a phenomenon where uh where the uh the company will seek a jurisdiction uh based on several factors. So the likelihood that they will get a license, the cost and uh then they will they will decide in what country in the European Union they will apply in which the uh the Mika regulation is pretty strict about it and the uh the regulators are also very strict about it. So it is very important to prove your local presence your reasoning why you want to apply in the uh in the country that you're applying in which is very hard. So for example, if we're talking about the uh about the board members, uh the the

highest ranking officers, uh the majority of them have to be local in inside of the of the relevant country. Uh they either have to be residents or they have to have some kind of connection to the country. So the less of a formal connection you have to the country, the more you have to prove to the regulator that you actually want to do business in that country. you actually want to target the clients inside of the country and uh you want to do marketing there and all your relevant personnel especially the uh the AML personnel the compliance personnel they know the local legal uh landscape and they uh they know all the all the specifics inside of that jurisdiction.

Uh so they have to they have to prove to the regulator that uh they not only know the uh the European background the European directives and regulations but they also know the uh the local specifics. So that is one one big part uh and one big problem that the foreign uh foreign applicants are facing. On another note, there's also uh a lot of a lot of applicants that uh will fail due to uh their internal procedures. Uh because uh a lot of the applicants, they just wanted to try it out. They uh opened up an AI chatbot. It sped out some internal document and uh they were

very very general. And if you if you actually tried to uh to conduct the business based on the processes inside of the internal documents, you couldn't do anything. And uh that is what the regulator will tell you. So uh you can you can probably start with some general documentation, but you need specialized help. Uh you need consultants. uh you need lawyers because you don't really uh you don't really stand a chance if uh you don't have anyone by your side who actually a knows the uh the regulation itself but b also knows the uh the licensing procedure. They know the uh the mood of the regulator. they know the

specific requirement that the that the regulator is is placing on the uh on the applicants because uh these specific requirements are not really based in the regulations but are more based on the uh uh on the background of the regulator and their own opinions. So you have to get specialized help to actually get all the documents in order uh to be able to uh to actually conduct business. So these were the the two main I'd say areas where a lot of the applicants failed and they did not even pass the uh the first stage which is the uh completeness of your application where the regulator will tell you okay you

submitted everything that you had to submit now we're going to take a look at the at the uh very specific procedures that you're that you're implying. Another problem were audited financial statements. So if you if you are a company and you're trying to apply for a for a mika license and uh you your company was functioning the year before the regulator will will require you to uh provide audited financial statements. So a lot of the applicants they uh they decided to go another way which is creating a new company and then applying uh for the new company which may be also a problem because if you want to uh if

you want to reorganize and if you want to actually fund or uh transfer some cash from the old company into the new company the the regulator will also tell you okay how do we know that the that the money is actually legit you need to provide us with the ultimate source of the money. So creating a new entity may not always be the the solution because you always have to prove the ultimate uh source of the funds that you uh that you were granted. So that can be a problem as well.

A lot of the crypto companies throughout Europe, they face a uh a certain a certain problem with uh banks refusing to open corporate accounts and safeguarding accounts. Uh this problem was supposed to be mitigated uh by many attempts to uh to amend uh local laws to require the banks to actually give you or open the the account unless there is a uh there's I'd say a reasonable a reasonable thing why they shouldn't open the account. And uh every every time they were trying to deny opening the account, they have to report it to the local regulator. H but it didn't help.

So uh the the banks were other way. And what they did was they would gradually wear you down asking more questions uh requiring more documents until you gave up. So they didn't technically deny you the account, but they just worn you down until you gave up. And one way to uh mitigate this problem can be uh to actually to actually be patient and uh a lot of the banks they will uh they will require certain amendments to your AML policies but uh what they what they also require is the anti-bribery and corruption policy which

is a policy that is not mandated by Mika. So, uh, technically you don't really need to have it to pass the licensing procedure, but if you if you'd like to if you'd like to open a bank account, they will most likely ask you for it. So, it is it is important to be prepared, to be patient, and to not give up. We'll we'll see how that will how that will go. Another very important topic uh is the uh AML specifics and the travel rule regulation.

uh for the crypto it is uh very different your your AML procedures are very different from from other financial financial institutions and uh the regulators are very careful about uh your your AML processes and how you're going to conduct them. So uh your AML policies they have to be very specific. Uh you have to have to have a stepbystep process on the the whole life cycle of for example the identification of the client. If you're transferring crypto you have to identify the counterparty as well. You have to make sure that the

transaction is legit. You have to make sure that the uh that the source wallet is legit. And all of these procedures are uh very strictly limited to how you describe them. And uh it is very important to uh actually know how you're going to do these processes and what tools you're going to be using. So for example, there's a lot of automated uh uh tools for example thumbs up or others that will help you with that process.

And there's another point which is the travel rule regulation which mandates that when you're transferring crypto along with the transfer you have to you have to transfer data as well that are identifying the counterparties. So, not only you have to have a process on how you're going to transfer the data, but if you're receiving crypto as well, you have to have processes to ensure that the person you're receiving the crypto from actually provides you with the data that you need, which can be technologically challenging as well.

And then there's DORA which is the uh I'd say cyber security and uh very IT specific regulation and uh for example in the Czech Republic the Dura regulation and uh your IT procedures are roughly 60% of the whole application and the regulators are very strict about this for example uh you have to have skilled staff so uh you have to you have to appoint your cyber security officer uh you have to appoint your uh your IT I'd say maintenance guy who does and who runs all the processes on the day-to-day

basis you have to provide their uh their knowledge to the regulators so they can check that uh they're sufficient for uh for their tasks and uh the crypto asset service providers were kind of unlucky because the uh transitional period uh it began on the end of July and the Dora regulation went into force at the beginning of the year. So uh a lot of the uh skilled staff they kind of disappeared from the market because a lot of the financial institutions they wanted to comply with Dora. So they uh they hired all of the all of the talent and there was no one left for the crypto

asset service providers which may be a problem. So if you're uh if you're thinking about applying I'd say that uh compliance with the DORA regulation and all of the processes is I think the most essential part of the proceedings. If you don't have a good technical background, you most likely will not pass. And if you do not have skilled staff, you will most not likely spa pass. And then we also have regulatory changes because the uh licensing procedure it can take 8, 10, 12 months at most. And during that time the the regulation may

change especially the uh the opinions on uh on the regulation from uh from ESMA from EBA and also from local regulators and they will ask you for it. So for example uh lately there there has been a change in uh in interest on uh uh on fiat currency that you're holding for a client. So if you have a if you have a safeguarding account and you're holding client funds and you're making an interest on it, you are now not allowed to actually pocket the interest, but you have to you have to give the interest to the client themselves.

So you have to you have to set up processes to uh to actually give back the interest as well. And on another note, for example, uh the uh the PSD2 regulation, the uh the payment regulation, uh once you are a uh crypto asset service provider and uh you'd like to you'd like to provide your services uh with uh EMTs as well, you have to have a double license because any transfers of EMTs or custody of EMTs is considered a uh uh is considered a uh PSD relevant event. So you have to have two licenses

which is uh the first ever the first time ever that this happened that a single business model actually requires two licenses. Uh we'll see we'll see how that will pan out and we'll see we'll see the future. So you have to you have to really keep in mind the regulatory changes and you have to be able to actually comply with them in time because once the regulator asks you for more information you have at most 20 business days to comply to come up with an answer which may be a short time. So uh you have to be you have to be very very rigorously prepared for that.

So how do you avoid the uh the future compliance headache? How do you actually get prepared for uh your regulated business? So firstly, I would uh I would recommend that the processes that you're describing during the licensing procedure that you're actually able to maintain them that they're actually sustainable. So uh when the regulator asks asks you for a specific information when they ask you to modify a process sure you will comply with the request but what next you you got the license and now you cannot you cannot really comply with all the requirements that

you've set out for yourself. So the most recommendable thing is to actually very it's very self-explanatory but promise only something that you can actually do or be prepared to do and uh what is I'd say the the best practice is when you're going through the licensing procedure uh you build a road map of implementation so what you're going to implement and when in what order and once you get the license I'd Okay, the most prioritized area should be your relationship with customers. So all the client-f facing documents, all the interfaces because that's the first

thing that the regulator will actually look at because they're publicly available right? Second is AML processes and if you're providing custody all of the uh custody proceedings all of your wallet management all of your custody management and all of these processes and then there's there's Dora and all of the all of the other processes. So that is that is actually the uh I'd say the the best course of action that you should take and uh that it works.

So uh yeah I think that's uh that's it from my from my side. It was a a very a very short presentation but I hope it would be useful to you. So uh I'll I'll be here if you're if if you can talk if you'd like to talk. And uh now we have uh we have some time for uh for some questions from from the audience. So if any of you have have a question then I I'll I'll answer it. >> No questions.

>> Uh hi Anton here. Uh it concerns a real story uh by bit >> sorry >> by bit they uh ma uh license in Austria um >> what do you think is going on in uh uh following months uh because it's uh really happening now so how to avoid uh for other entities thanks >> yeah um Well, the the the thing is that it depends on the jurisdiction. If you uh if you are granted a license, uh the regulator will actually kind of know

your your business model. They will know your weaknesses and uh they will actually keep track of all the uh of all the necessary changes that you have to implement after being granted the license. So uh if there's a lot of shortcomings they will probably you will probably the first one on the list that will they will get an audit from from your reg regulator. So uh it's very hard to tell what will what will happen but uh we'll we'll see uh once once the situation kind of calms itself down.

It's very very hard to tell. Thank you.