Italian VASP registration regime

Italy was one of the first EU member States which adopted a domestic regime for the provision in the country of virtual currency related services.

Indeed, in the context of the implementation in the domestic legal framework of the so-called 4AMLD (Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing), Italy introduced the obligation for virtual currency service providers to comply with anti-money laundering (“AML”) rules and registration requirements. Such requirements were initially applicable to providers engaging in exchange services between virtual currencies and fiat currencies only.

At an EU level, instead, only in 2018 with the issuance of the so-called 5AMLD (i.e. Directive (EU) 2018/843) which amended the 4AMLD, the EU legislator introduced a registration requirement applicable to virtual currency exchangers and custodian wallet providers.

Italy took then again a different and more stringent approach with respect to the EU legal framework as, in the context of the implementation of 5AMLD in the domestic legal framework, the applicability of the domestic regime above mentioned was extended to virtual currency service providers and custodian wallet providers (jointly hereinafter “VASPs”) providing a broad range of services related to the use of virtual currencies, in addition to exchange services.

Notwithstanding the Italian steps ahead of the EU legislator, the Italian register of VASPs kept by Organismo per la gestione degli elenchi degli Agenti in attività finanziaria e dei Mediatori creditizi” (“OAM”) went live only in mid-2022 as necessary secondary implementing measures for the establishment of such register were missing. 

To date VASPs are subject to registration with OAM if they provide in Italy, even online, one of the following services: services functional to the use and exchange of virtual currencies and/or their exchange from or into fiat currencies or digital representations of value, including the exchange into other virtual currencies; services of issuing, offering of virtual currencies; transfer and settlement services in virtual currencies; any other service functional to the acquisition, trading or intermediation in the exchange of virtual currencies (e.g., execution, receipt, transmission of virtual currency orders on behalf of third parties, virtual currency placement services, virtual currency advisory services); custodian wallet services.

As one may note, the list of services requiring a registration in Italy is quite broad and also includes services “functional to”. There are no indications on how broadly this term is to be interpreted, but it seems the legislator intentionally used a vague delineation of the boundaries in order to include as much activities as possible under the registration regime.

In order to provide such services toward Italian customers and be registered with OAM, in case of legal persons, it is necessary to have an establishment on the ground. More specifically, VASPs must have a registered office in Italy or, in case of EU entities, a permanent establishment in Italy. This means that in case of non-EU entities, an Italian subsidiary is to be established while in case of EU entities, a branch must be set-up in Italy. Other specific requirements apply in case of VASPs natural persons.

The registration process, however, is quite straightforward and appears to be easier with respect to the VASP regime adopted in other EU countries (for example, both Ireland and Germany provide for a more burdensome registration/licencing regime).

In the context of the application for registration with OAM, there is no requirement to file with OAM AML internal policies and/or procedures and only specific information on the company/branch, its legal representative and the business carried out must be provided.

Once enrolled, VASPs are subject to on-going obligations mainly in terms of reporting requirements - as VASPs are required to transmit to OAM on a quarterly basis, specific data relating to customers and transactions carried out in Italy – and payment of supervisory fees.

VASPs are also subject to the general Italian AML regime including, among other things, customer due diligence, record-keeping, suspicious transactions reporting and internal organizational requirements. There are no specific AML rules tailored to VASP activities.

As a general comment, Italy gold-plated the implementation of both 4AMLD and 5AMLD (as defined at the beginning of this article) and adopted a more stringent and detailed AML regime with respect to other EU member States. This means that for EU entities, a gap analysis between the domestic and Italian AML regime is strongly suggested. Indeed, Italian regulators are more stringent and formalistic in the enforcement and supervision of AML rules.

Looking at the EU developments, we note that there are different pieces of legislation regulating VASP activities, currently under advanced discussions, which may impact the current Italian VASP regime: first of all the so-called EU AML package which will introduce a specific AML regime applicable to VASP activities. Some rules will be set out under EU Regulations and will therefore be directly applicable to all member States, including Italy. Therefore, once may expect a review of the Italian AML legal framework, once the new EU rules are enacted. In this scenario the Italian legislator might also review the current VASP registration regime and/or current applicable on-going requirements.

Likewise, the Regulation on Markets in Crypto-Assets (“MiCAR”), still to be formally adopted at an EU level, may have an impact on the current domestic VASP regime. Indeed, MiCAR will introduce an authorisation requirement for crypto-asset service providers (CASPs) which will be subject to certain conduct of business and authorisation requirements in their member States. Differently from the VASP regime set out under 5AMLD, CASPs will be able to passport their authorisation across-EU. At this stage, the impact of MiCAR on the current Italian VASP regime is not clear, also considering that the domestic regime applies to a broader category of service providers.

As a result, only the future developments at an EU level and the approach taken by local regulators will clarify if and how the existing and new regime will merge.

Authored by Jeffrey Greenbaum, Elisabetta Zeppieri, and Rebecca Carbone.